topic How to use a variable to limit a sort list length? in Splunk Search

How to use a variable to limit a sort list length?

bebowi — Wed, 19 Apr 2017 19:26:04 GMT

I want to find the highest ten results of a search and group the others up. I'm using the following search:

index=foo | stats sum(apple) as fruit by tree |sort limit =2 - fruit | append [search index=foo | stats count sum(apple) as fruit by tree | eval counter=(count-10) | sort limit =counter + fruit | stats sum(fruit) | fillnull value="other" tree]

I've also tried to use "tonumber" and "convert" function. It leads to the folowing error:

Error in 'sort' command: Invalid option value. Expecting a 'non-negative integer' for option 'limit'. Instead got 'counter'

How to get a list like this:
tree1 | 8
tree2 | 5
other | 11

Re: How to use a variable to limit a sort list length?

somesoni2 — Wed, 19 Apr 2017 19:36:05 GMT

I would try like this

index=foo | stats sum(apple) as fruit by tree | sort 0 -fruit | streamstats count as rank | eval tree=if(rank=1 OR rank=2 , tree,"other" 
| stats sum(fruit) as fruit by tree

Re: How to use a variable to limit a sort list length?

bebowi — Thu, 20 Apr 2017 15:10:14 GMT

It works, thank you very much

Re: How to use a variable to limit a sort list length?

jancjaarsma — Sun, 30 Sep 2018 13:37:47 GMT

This answer may be fitted for the question. However it does not answer the question: how to use a variable to limit a list. I want to limit the number of bars in a barchart, depending on the days of the month. I can calculate the number of days, but when i use that variable to fill in the limit parameter, i got the same error as mentioned above.