Splunk Search

How to develop a table that displays top 10 counts, unique distinct counts, and total counts?

JPaule
Explorer

I have the following query to display top 10 counts, for example:

sourcetype=IIS | top 10 URL

This returns the total counts of URL hits and percentage of the top 10 URLs. How can I show the unique/distinct counts in the column next to total counts?

Tags (4)
0 Karma

ddrillic
Ultra Champion

Maybe something like -

sourcetype=IIS | stats count by URL, <sub URL field>

If you have a sub URL field, like domain for example...

0 Karma
Get Updates on the Splunk Community!

Combine Multiline Logs into a Single Event with SOCK - a Guide for Advanced Users

This article is the continuation of the “Combine multiline logs into a single event with SOCK - a step-by-step ...

Everything Community at .conf24!

You may have seen mention of the .conf Community Zone 'round these parts and found yourself wondering what ...

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...