Is there a way to limit the amount of summary events stored by sitop. I have scheduled search running every night with a sitop limit=20 (to store only the 20 top results) but the limit option does s...
I am using the following query to load firewall data into a summary index I've created:
host="aegis1.grc.nasa.gov" | sitop policy_id
This query runs every 5 minutes and it working well.
H...
I've got a summary index query which currently matches only one (1) event in my existing data. I've run the fill_summary_index.py to backfill the data for that time period. When I attempt to fetch ...
...’ve looked at the loadjob command but that has a limit of 25,000 events.
I've looked at the sitop command but that limits the second search to just a top . As far as I know top is limited to a...
Hi
How can I Run SPL command once and store result to access result faster next time.
for e.g. I need to analyses large logs every night and in next day access to "save search" and "dashboards" ...
In the latest versions of Splunk, summary indexing does not deduct from the licensed indexing capacity. How does Splunk determine if data is summary data? Is it through use of the summary search co...
...ith the sitop command, is there another way to calculate the top 5 clients which displays volume by clientkey and total percentage of overall volume by clientkey?
Thanks in advance for your help!!!
...time | sitop 5 field1 by _time
What we notice is that there are two buckets created within a single day. One has a 12:00 AM value and the other has a 5:00 PM value. We just need all of the e...
...uery" is a defined field in my dns eventtype") such as:
sourcetype="dns" query_type="A" query!="some.domain.x" | sitop query limit="50"
At this point though, this has made my search quite long as t...