This would be a piece of cake for someone who uses SPLUNK. I am  doing a search using the 'stats', çount' and sort commands in the botsv1 index. I am to find the top ten URI's in ascending order. What is the SPL command? 

Hi all! Hoping you can help me out. We are setting up an alert in splunk that will feed into servicenow, that when triggered will allow us to reach out to our users whenever they lock themselves out instead of them calling through to IT desk. We don't want a snow alert to trigger every time they show up in the splunk seach however, instead if they have had an alert created in the last 4 hours for example they are not included and it only checks for new people in that time frame. After the time period has elapsed they can then be included in the alert again. I have the search to a point where it is finding the users with issues and creating a transaction so we are getting them at the point they would be calling us, just stuck on that last bit.  index=prd_example sourcetype=LogSource "host=Host* | transaction UserID EventDescription maxspan=4h | table UserID EventDescription LockoutTime FirstName LastName EventCode eventcount | where eventcount >= 3 | sort -_time Any help would be greatly appreciated. I'm not even sure if this can be done at the splunk level or needs to be done at the SNow end

Hello and thank you for your time. I would like to run a search in splunk, using the results against inputlookup lists to return the stats or multiple stats. Example: My search is: index="MyIndex" AND host="MyHost" AND (*string1* OR "*string2*" OR "*string3*") | dedup user | table user user_results user.name1 user.name2 user.name3 using those results: | inputlookup ACBounceList_a-c.csv | inputlookup append=t ACBounceList_d-g.csv | inputlookup append=t ACBounceList_h-l.csv | inputlookup append=t ACBounceList_m-q.csv | inputlookup append=t ACBounceList_r-s.csv | inputlookup append=t ACBounceList_t-v.csv | inputlookup append=t ACBounceList_w-z.csv | stats count by field_stats_wanted | where inputlookup_user = user_results   resulting in: field_stats_wanted                     count value1                                                     30 value2                                                     35 etc                                                            etc   Any assistance with this would be greatly appreciated.