About Yashvik

Yashvik · ‎09-19-2023

Thanks a lot for the response @gcusello , it works.

Yashvik · ‎09-18-2023

Hi @gcusello I used the same search which you shared above and didn't made any changes. I will share the screenshot shortly as I am getting some errors in uploading the picture.

Yashvik · ‎09-18-2023

Hello @gcusello Thanks for the response. Unfortunately, I see only empty values for sourcetype column. other 3 fields showing the info.

Yashvik · ‎09-17-2023

Hello @gcusello Thanks a lot for the swift response. the query gives the most of info I was looking for. However, it contains multiple entries for single index. Lets say If Index A has 3 sourcetypes, it appears in 3 rows. Can we group them in a single row? e.g: _time index sourcetype Vol_GB percentage 17th Sep Main st1 st2 st3 100G 10.00%

Yashvik · ‎09-16-2023

Hello All, I need to identify the top log sources which are sending large data to Splunk. Tried Licence master dashboard which isn't helping much. My requirement is to create a table which contains following fields. e.g: sourcetype, vol_GB, index, percentage.

Posts	5
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎09-16-2023

Online Status	Offline
Date Last Visited	‎09-19-2023 08:40 PM

How to write a SPL query to identify top 20 larges...

Re: How to write a SPL query to identify top 20 la...

Re: How to write a SPL query to identify top 20 la...

Re: How to write a SPL query to identify top 20 la...

Re: How to write a SPL query to identify top 20 la...

How to write a SPL query to identify top 20 larges...