https://community.splunk.com/t5/Splunk-Search/how-to-create-a-top-5-of-results-and-a-bin-for-the-rest-of-them/m-p/71438#M17874 <P>This does not work, unfortunately. Even a plain <CODE>top 5 total</CODE> returns empty results.</P> Tue, 24 Sep 2013 14:07:36 GMT wsw70 2013-09-24T14:07:36Z https://community.splunk.com/t5/Splunk-Search/how-to-create-a-top-5-of-results-and-a-bin-for-the-rest-of-them/m-p/71436#M17872 <P>Hi,</P> <P>Now that I know, thanks to <A href="http://answers.splunk.com/users/1749/rturk">R.Turk</A>, <A href="http://answers.splunk.com/answers/103451/how-to-sort-a-stacked-bar-chart-by-length">how to sort stacked bar charts</A> I wanted to pick a top 5 of the results. This works fine by adding a <CODE>| head 5</CODE> to the search. </P> <P>Is there a way to gather all the other events (the ones which did not make it to the top 5) in a separate bar called "others" (or whatever)? </P> <P>Thanks!</P> Tue, 24 Sep 2013 12:52:53 GMT https://community.splunk.com/t5/Splunk-Search/how-to-create-a-top-5-of-results-and-a-bin-for-the-rest-of-them/m-p/71436#M17872 wsw70 2013-09-24T12:52:53Z https://community.splunk.com/t5/Splunk-Search/how-to-create-a-top-5-of-results-and-a-bin-for-the-rest-of-them/m-p/71437#M17873 <P>Could this be of use? <CODE>top</CODE> has a <CODE>useother</CODE> parameter that can be used to bunch the remaining events together into <CODE>OTHER</CODE>, like so;</P> <PRE><CODE>sourcetype=access_combined | top 5 clientip useother=t </CODE></PRE> <P>/K</P> Tue, 24 Sep 2013 13:58:49 GMT https://community.splunk.com/t5/Splunk-Search/how-to-create-a-top-5-of-results-and-a-bin-for-the-rest-of-them/m-p/71437#M17873 kristian_kolb 2013-09-24T13:58:49Z https://community.splunk.com/t5/Splunk-Search/how-to-create-a-top-5-of-results-and-a-bin-for-the-rest-of-them/m-p/71438#M17874 <P>This does not work, unfortunately. Even a plain <CODE>top 5 total</CODE> returns empty results.</P> Tue, 24 Sep 2013 14:07:36 GMT https://community.splunk.com/t5/Splunk-Search/how-to-create-a-top-5-of-results-and-a-bin-for-the-rest-of-them/m-p/71438#M17874 wsw70 2013-09-24T14:07:36Z https://community.splunk.com/t5/Splunk-Search/how-to-create-a-top-5-of-results-and-a-bin-for-the-rest-of-them/m-p/71439#M17875 <P>eeh you need to do top 5 <EM>something</EM>. Is <CODE>total</CODE> a field that exists in some/most/all of your events?</P> <P>You know that <CODE>top</CODE> is not the same as <CODE>max</CODE>? <CODE>top</CODE> will look at the frequency of values for the specified field, not whether a value is higher than another.</P> <P>/K</P> Tue, 24 Sep 2013 20:01:50 GMT https://community.splunk.com/t5/Splunk-Search/how-to-create-a-top-5-of-results-and-a-bin-for-the-rest-of-them/m-p/71439#M17875 kristian_kolb 2013-09-24T20:01:50Z https://community.splunk.com/t5/Splunk-Search/how-to-create-a-top-5-of-results-and-a-bin-for-the-rest-of-them/m-p/71440#M17876 <P>Sorry, I was not clear enough when referring to <A href="http://answers.splunk.com/answers/103451/how-to-sort-a-stacked-bar-chart-by-length">the previous post on sorting bar charts</A>. The search over there was </P> <P><CODE>&lt;base search&gt; <BR /> | chart count over N_vendor by N_subnetname <BR /> | addtotals fieldname=total <BR /> | sort -total <BR /> | fields - total</CODE> </P> <P>so <CODE>total</CODE> is indeed defined.</P> Wed, 25 Sep 2013 05:47:54 GMT https://community.splunk.com/t5/Splunk-Search/how-to-create-a-top-5-of-results-and-a-bin-for-the-rest-of-them/m-p/71440#M17876 wsw70 2013-09-25T05:47:54Z