Visualize field value highs and lows
This topic discusses how to use the transforming commands, top and rare, to create charts that display the most and least common values.
The top and rare commands
The top command returns the most frequent values of a specified field in your returned events. The rare command, returns the least common value of a specified field in your returned events. Both commands share the same syntax. If you don't specify a limit, the default number of values displayed in a top
or rare
is ten.
Examples
Example 1: Generate a report that sorts through firewall information to list the top 100 destination ports used by your system:
sourcetype=firewall | top limit=100 dst_port
Example 2: Generate a report that shows you the source ports with the lowest number of denials.
sourcetype=firewall action=Deny | rare src_port
A more complex example of the top command
Say you're indexing an alert log from a monitoring system, and you have two fields:
msg
is the message, such asCPU at 100%
.mc_host
is the host that generates the message, such aslog01
.
How do you get a report that displays the top msg
and the values of mc_host
that sent them, so you get a table like this:
Messages by mc_host |
CPU at 100% |
log01 |
log02 |
log03 |
Log File Alert |
host02 |
host56 |
host11 |
To do this, set up a search that finds the top message
per mc_host
(using limit=1
to only return one) and then sort
by the message count
in descending order:
sourcetype=alert_log | top 1 msg by mc_host | sort count
Create charts that are not (necessarily) time-based | Create reports that display summary statistics |
This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.13, 8.1.14, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.2.11, 8.2.12, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9, 9.0.10, 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.1.4, 9.1.5, 9.1.6, 9.2.0, 9.2.1, 9.2.2, 9.2.3, 9.3.0, 9.3.1, 8.1.0, 8.1.10, 8.1.11, 8.1.12
Feedback submitted, thanks!