Implementing Splunk: Big Data Reporting and Development for Operational Intelligence

Rebuilding top

The top command is very simple to use, but is actually doing a fair amount of interesting work. I often start with top, then switch to stats count, but then wish for something that top provides automatically. This exercise will show you how to recreate all of the elements, so that you might pick and choose what you need.

Let's recreate the top command by using other commands.

Here is the query that we will replicate:

sourcetype="impl_splunk_gen" error
  | top useother=t limit=5 logger user

The output looks like this:

To build count, we can use stats like this:

sourcetype="impl_splunk_gen" error
  | stats count by logger user

This gets us