Skip to content

Instantly share code, notes, and snippets.

@yjaaidi

yjaaidi/splunk-most-request-resource-by-user

Last active July 9, 2017 19:16
Show Gist options
  • Star 1 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save yjaaidi/8844942 to your computer and use it in GitHub Desktop.
Save yjaaidi/8844942 to your computer and use it in GitHub Desktop.
Download ZIP
Splunk Search Query - Most Request Resource By User
Raw
splunk-most-request-resource-by-user
stats count by user fqdn
| eventstats sum(count) as count_by_user by user
| eval percent=count/count_by_user
| table user, fqdn, percent, count, count_by_user
| sort - percent
| search count_by_user > 100
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment