Splunk Enterprise

top 1000 by appiD

lpolo
Motivator

Hi,

From a set of log events I need to get the daily Top 1000 calls by each appId and clientId.
How can I do this in a single query without using the append command?

log events:

timestamp call=123 client=a appId=1
timestamp call=123 client=a appId=1
timestamp call=123  client=a appId=1
timestamp call=12 client=a appId=1
timestamp call=123 client=b appId=1
timestamp call=123 client=b appId=2
....
Nth event

So the result set based on these logs is :

day | call | client | appId | count
07/14/2020 | 123 | a | 1 | 3
07/14/2020 | 12 | a | 1 | 2
07/14/2020 | 123 | b | 1 | 1
07/14/2020 | 123 | b | 2 | 1 

The idea is to get the Top 1000 calls by each tuple of client : appId.
Thanks for your help.

Labels (1)
Tags (1)
0 Karma

to4kawa
Ultra Champion
index=<index name> sourcetype=<your sourcetype>
| bin _time span=1d
| stats count by _time call client appId
| eval day=strftime(_time,"%m/%d/%Y")
| table day call client appId count
| sort 1000 - count

how about this?

lpolo
Motivator

Thanks for the query, It does not provide the intended result of Top 1000 calls for each tuple of client and appId.  I have been able to get the intended result by using the append command. The problem is that the query is too slow. I asked the question to find out if there is a trick that I am not aware of.... without using the append command. 

0 Karma
Get Updates on the Splunk Community!

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...

AppDynamics is now part of Splunk Ideas

Hello Splunkers, We have exciting news for you! AppDynamics has been added to the Splunk Ideas Portal. Which ...

Advanced Splunk Data Management Strategies

Join us on Wednesday, May 14, 2025, at 11 AM PDT / 2 PM EDT for an exclusive Tech Talk that delves into ...