top command is very simple to use, but is actually doing a fair amount of interesting work. I often start with
top, then switch to
stats count, but then wish for something that
top provides automatically. This exercise will show you how to recreate all of the elements, so that you might pick and choose what you need.
Let's recreate the
top command by using other commands.
Here is the query that we will replicate:
sourcetype="impl_splunk_gen" error | top useother=t limit=5 logger user
The output looks like this:
count, we can use
stats like this:
sourcetype="impl_splunk_gen" error | stats count by logger user
This gets us