Rebuilding top

The top command is very simple to use, but is actually doing a fair amount of interesting work. I often start with top, then switch to stats count, but then wish for something that top provides automatically. This exercise will show you how to recreate all of the elements, so that you might pick and choose what you need.

Let's recreate the top command by using other commands.

Here is the query that we will replicate:

sourcetype="impl_splunk_gen" error
  | top useother=t limit=5 logger user

The output looks like this:

To build count, we can use stats like this:

sourcetype="impl_splunk_gen" error
  | stats count by logger user

This gets us most of the way to our end goal:

To calculate the percentage that top includes, we will first need the total number of events. The eventstats command lets us add statistics to every row, without replacing the rows.

sourcetype="impl_splunk_gen" error
  | stats count by logger user
  | eventstats sum(count) as totalcount

This adds our totalcount column...