Splunk Search

timechart count by source, top talker by span

Engager

Hi Everyone,

I'm trying to craft a timechart that shows the top "hits per source" and then only display the top source per the 5 minute span.

something like this "sourcetype=firewall | timechart span=5m count by src limit=1"

but this will only display 1 source, not the 1 top source per slice of time.

Thoughts?

Tags (1)
0 Karma
1 Solution

Communicator

You might want to try the Bucket command instead of timechart; it will group your events into sets based upon a span you define. To find the single source you're interested in, I would then suggest the Top command and set its limit to 1.

The overall query I tried looked something like this:

... | bucket _time span=5m | top src by _time limit=1

I can't guarantee it's the single most efficient method of solving the problem, but I'm pretty sure it will return the results you are looking for.

Does this help answer your question?

View solution in original post

Communicator

You might want to try the Bucket command instead of timechart; it will group your events into sets based upon a span you define. To find the single source you're interested in, I would then suggest the Top command and set its limit to 1.

The overall query I tried looked something like this:

... | bucket _time span=5m | top src by _time limit=1

I can't guarantee it's the single most efficient method of solving the problem, but I'm pretty sure it will return the results you are looking for.

Does this help answer your question?

View solution in original post

Engager

That worked beautifully, thank you!

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!