Splunk Search

top senders by number of attachments

moayadalghamdi
Path Finder

hello splunker !

 

in splunk, i want to print top email sender by the number of attachment, my command is:

index=emaileventtype="email-events" action=delivered | top 10 sender by AttachCount

but it produces more fields and they aren't sorted, like this:

moayadalghamdi_1-1613905737482.png

and as you can see that it produced more than 10 values

i've also tried:

index=emaileventtype="email-events" action=delivered | top 10 sender by AttachCount
| stats sum(AttachCount) as AttachCount by sender
| top 10 AttachCount

 

and here's the result:

moayadalghamdi_2-1613905989211.png

 

 

please help me, i need two fields only, top sender by AttachCount 

 

 

Thanks

Labels (2)
0 Karma
1 Solution

ITWhisperer
Legend

Your by clause on the top command is grouping then getting the top within each group, which doesn't sound like what you are after. Try something like this

index=emaileventtype="email-events" action=delivered 
| stats sum(AttachCount) as AttachCount by sender
| sort 10 -AttachCount

View solution in original post

ITWhisperer
Legend

Your by clause on the top command is grouping then getting the top within each group, which doesn't sound like what you are after. Try something like this

index=emaileventtype="email-events" action=delivered 
| stats sum(AttachCount) as AttachCount by sender
| sort 10 -AttachCount

View solution in original post

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!