https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-exclude-the-top-20-noisy-results-and/m-p/383769#M112084 <P>I have a splunk search for a list of users performing a particular task. I want to exclude the top 20 noisy results and fetch the other results. How can I do it?<BR /> Please help me with this, my sample query is :</P> <PRE><CODE>source="x" | stats count by a,b | fields + a,b,count | sort count desc. </CODE></PRE> <P>Now this generates a big list of results out of which I want to filter out the top 20 noisy results. I tried top 20 followed by the rare command or tail with the reverse command but it doesn't fetch the right results.</P> Tue, 21 May 2019 13:30:01 GMT phant0mgh0st 2019-05-21T13:30:01Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-exclude-the-top-20-noisy-results-and/m-p/383769#M112084 <P>I have a splunk search for a list of users performing a particular task. I want to exclude the top 20 noisy results and fetch the other results. How can I do it?<BR /> Please help me with this, my sample query is :</P> <PRE><CODE>source="x" | stats count by a,b | fields + a,b,count | sort count desc. </CODE></PRE> <P>Now this generates a big list of results out of which I want to filter out the top 20 noisy results. I tried top 20 followed by the rare command or tail with the reverse command but it doesn't fetch the right results.</P> Tue, 21 May 2019 13:30:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-exclude-the-top-20-noisy-results-and/m-p/383769#M112084 phant0mgh0st 2019-05-21T13:30:01Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-exclude-the-top-20-noisy-results-and/m-p/383770#M112085 <P>Hello,</P> <P>After sorting your data, you can try that : </P> <PRE><CODE>| streamstats count as nb | where nb &gt; 20 </CODE></PRE> <P>This will remove the first 20 rows of your table <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span><BR /> Let me know if it helps you.</P> Tue, 21 May 2019 15:42:12 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-exclude-the-top-20-noisy-results-and/m-p/383770#M112085 KailA 2019-05-21T15:42:12Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-exclude-the-top-20-noisy-results-and/m-p/383771#M112086 <P>The reason is because, sort limits to 10K <A href="https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/sort">results</A> by default settings.<BR /> An easier option is to do the limiting before itself</P> <PRE><CODE>source="x" | top a by b </CODE></PRE> Tue, 21 May 2019 15:44:12 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-exclude-the-top-20-noisy-results-and/m-p/383771#M112086 koshyk 2019-05-21T15:44:12Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-exclude-the-top-20-noisy-results-and/m-p/383772#M112087 <P>@phant0mgh0st Try something like below to exclude top 20 noisy results</P> <PRE><CODE>source="x" | stats count by a,b | fields + a,b,count | sort 0 count desc | streamstats count as id| where id &gt; 20 </CODE></PRE> Tue, 21 May 2019 16:04:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-exclude-the-top-20-noisy-results-and/m-p/383772#M112087 Vijeta 2019-05-21T16:04:39Z