Using the Twitter App - Splunk Essentials - page 151

2. The object entities.hashtags{}.text is renamed as hashtags .
3. The field hashtags is selected.
4. The field is expanded into multiple values.
5. The top hashtags are listed (the default is 10).
Top Mentions - last 15 minutes
In the code for the Top Mentions panel, we look at how to construct a panel of the top
usernames mentioned in the last 15 minutes:
index=twitter | rename entities.user_mentions{}.screen_name as mentions | fields
mentions | mvexpand mentions | top mentions
Let's go through our construction of this code:
1. Again, use the Twitter index.
2. Rename the object entities.user_mentions{}.screen_name to
mentions .
3. Select the field mentions .
4. Expand the mentions field into multiple values.
5. List the top 10 mentions.
Time Tweet Zones - 15 minutes
Here we show the code for creating the panel that shows the time zones from which most
of the tweets in the last 15 minutes came:
index=twitter | rename user.utc_offset as z | seull | eval z=round(z/3600) | stats count
by z | sort +z
Here are the steps to create this code:
1. Use the Twitter index.
2. Rename the object user.utc_offset , which is the number of seconds of dif-
ference between the time and Greenwich Mean Time (GMT), as z .
3. Search all values of z . Treat those ending in ! as null.
4. Evaluate z equal to z/3600. 3600 is the number of seconds in an hour. This gives
you the number of hours plus or minus GMT.
5. Count the number of tweets occurring in each time zone.
6. Sort by the value of z in ascending order.