Rebuilding top

The top command is very simple to use but is actually doing a fair amount of interesting work. I often start with top, then switch to stats count, but then wish for something that top provides automatically. This exercise will show you how to recreate all the elements so that you might pick and choose what you need.

Let's recreate the top command by using other commands.

Here is the query that we will replicate:

sourcetype="impl_splunk_gen" error 
| top useother=t limit=5 logger user 

The output looks like this:

To build count, we can use stats like this:

sourcetype="impl_splunk_gen" error 
| stats count by logger user 

This gets us most of the way towards our final goal:

To calculate the percentage that top includes, we will first need the total number of events. The eventstats command lets us add statistics to every row without replacing the rows:

sourcetype="impl_splunk_gen" error 
| stats count by logger user 
| eventstats sum(count) as totalcount 

The following adds our totalcount...