Splunk Enterprise

top 1000 by appiD

lpolo
Motivator

Hi,

From a set of log events I need to get the daily Top 1000 calls by each appId and clientId.
How can I do this in a single query without using the append command?

log events:

timestamp call=123 client=a appId=1
timestamp call=123 client=a appId=1
timestamp call=123  client=a appId=1
timestamp call=12 client=a appId=1
timestamp call=123 client=b appId=1
timestamp call=123 client=b appId=2
....
Nth event

So the result set based on these logs is :

day | call | client | appId | count
07/14/2020 | 123 | a | 1 | 3
07/14/2020 | 12 | a | 1 | 2
07/14/2020 | 123 | b | 1 | 1
07/14/2020 | 123 | b | 2 | 1 

The idea is to get the Top 1000 calls by each tuple of client : appId.
Thanks for your help.

Labels (1)
Tags (1)
0 Karma

to4kawa
Ultra Champion
index=<index name> sourcetype=<your sourcetype>
| bin _time span=1d
| stats count by _time call client appId
| eval day=strftime(_time,"%m/%d/%Y")
| table day call client appId count
| sort 1000 - count

how about this?

lpolo
Motivator

Thanks for the query, It does not provide the intended result of Top 1000 calls for each tuple of client and appId.  I have been able to get the intended result by using the append command. The problem is that the query is too slow. I asked the question to find out if there is a trick that I am not aware of.... without using the append command. 

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...