Regarding splunk query

Question

I have some audio files in S3 bucket. I want to write a splunk query to find the top 500 audio files and categorize them by date and store them in a folder. Also I want to do it every night. What should be my query?

Answer 1

You would do something like the following.

index=audiofiles earliest=-1d@d | stats count by title

The earliest=1d@d means you only want to look at the last day's worth of logs. The stats command counts the frequency of each song, by title. I am assuming that there is a title field in your data.

You would probably choose to schedule a search like this to run every night. Should you wish to save the results of this data, you would write this data into a summary index with a collect command, or write it out to a CSV with outputcsv command