Splunk Search

top senders by number of attachments

moayadalghamdi
Path Finder

hello splunker !

 

in splunk, i want to print top email sender by the number of attachment, my command is:

index=emaileventtype="email-events" action=delivered | top 10 sender by AttachCount

but it produces more fields and they aren't sorted, like this:

moayadalghamdi_1-1613905737482.png

and as you can see that it produced more than 10 values

i've also tried:

index=emaileventtype="email-events" action=delivered | top 10 sender by AttachCount
| stats sum(AttachCount) as AttachCount by sender
| top 10 AttachCount

 

and here's the result:

moayadalghamdi_2-1613905989211.png

 

 

please help me, i need two fields only, top sender by AttachCount 

 

 

Thanks

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Your by clause on the top command is grouping then getting the top within each group, which doesn't sound like what you are after. Try something like this

index=emaileventtype="email-events" action=delivered 
| stats sum(AttachCount) as AttachCount by sender
| sort 10 -AttachCount

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Your by clause on the top command is grouping then getting the top within each group, which doesn't sound like what you are after. Try something like this

index=emaileventtype="email-events" action=delivered 
| stats sum(AttachCount) as AttachCount by sender
| sort 10 -AttachCount
Get Updates on the Splunk Community!

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...