https://community.splunk.com/t5/Splunk-Search/How-to-limit-my-search-to-return-only-the-top-10-results-based/m-p/74120#M18626 <P>You may want to use top for this.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/4.3.2/SearchReference/Top">http://docs.splunk.com/Documentation/Splunk/4.3.2/SearchReference/Top</A></P> <PRE><CODE>sourcetype="access" |eval bandwidth=round(bytes_sent/1024,2)| stats sum(bandwidth) as total_bandwidth | top limit=10 total_bandwidth by client_ip sourcetype="access" | eval bandwidth=round(bytes_sent/1024,2)|stats sum(bandwidth) as total_bandwidth | top limit=10 total_bandwidth by URL </CODE></PRE> <P>Hope that helps.</P> Wed, 13 Jun 2012 12:02:05 GMT Lamar 2012-06-13T12:02:05Z https://community.splunk.com/t5/Splunk-Search/How-to-limit-my-search-to-return-only-the-top-10-results-based/m-p/74118#M18624 <P>I am using these search queries and I want to restrict the search to return only the top ten results.</P> <P>How to do it ?</P> <P>The search queries I am using are :</P> <P>sourcetype="access" |eval bandwidth=round(bytes_sent/1024,2)| stats sum(bandwidth) BY client_ip </P> <P>sourcetype="access" | eval bandwidth=round(bytes_sent/1024,2)|stats sum(bandwidth) BY URL</P> <P>Thanks...</P> Mon, 28 Sep 2020 11:56:24 GMT https://community.splunk.com/t5/Splunk-Search/How-to-limit-my-search-to-return-only-the-top-10-results-based/m-p/74118#M18624 ranjyotiprakash 2020-09-28T11:56:24Z https://community.splunk.com/t5/Splunk-Search/How-to-limit-my-search-to-return-only-the-top-10-results-based/m-p/74119#M18625 <P>Try this:</P> <PRE><CODE>your_query | sort - sum(bandwidth) | head 10 </CODE></PRE> <P>you may want to name your field "bandwidth" as follow:</P> <PRE><CODE>sourcetype="access" | stats sum(bytes_sent) as bandwidth BY client_ip | eval bandwidth=round(bandwidth/1024,2) | sort - bandwidth | head 10 sourcetype="access" | stats sum(bytes_sent) as bandwidth BY URL | sort - bandwidth | eval bandwidth=round(bandwidth/1024,2) | head 10 </CODE></PRE> <P>Lp</P> Wed, 13 Jun 2012 11:53:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-limit-my-search-to-return-only-the-top-10-results-based/m-p/74119#M18625 lpolo 2012-06-13T11:53:41Z https://community.splunk.com/t5/Splunk-Search/How-to-limit-my-search-to-return-only-the-top-10-results-based/m-p/74120#M18626 <P>You may want to use top for this.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/4.3.2/SearchReference/Top">http://docs.splunk.com/Documentation/Splunk/4.3.2/SearchReference/Top</A></P> <PRE><CODE>sourcetype="access" |eval bandwidth=round(bytes_sent/1024,2)| stats sum(bandwidth) as total_bandwidth | top limit=10 total_bandwidth by client_ip sourcetype="access" | eval bandwidth=round(bytes_sent/1024,2)|stats sum(bandwidth) as total_bandwidth | top limit=10 total_bandwidth by URL </CODE></PRE> <P>Hope that helps.</P> Wed, 13 Jun 2012 12:02:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-limit-my-search-to-return-only-the-top-10-results-based/m-p/74120#M18626 Lamar 2012-06-13T12:02:05Z https://community.splunk.com/t5/Splunk-Search/How-to-limit-my-search-to-return-only-the-top-10-results-based/m-p/74121#M18627 <P>This is actually incorrect. The top command will deliver the most common values, not the greatest ones.</P> Wed, 13 Jun 2012 12:34:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-limit-my-search-to-return-only-the-top-10-results-based/m-p/74121#M18627 ziegfried 2012-06-13T12:34:44Z https://community.splunk.com/t5/Splunk-Search/How-to-limit-my-search-to-return-only-the-top-10-results-based/m-p/74122#M18628 <P>The head command will give you the first 10 results whereas the top command will give you the most common values of a particular field.</P> Wed, 13 Jun 2012 12:35:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-limit-my-search-to-return-only-the-top-10-results-based/m-p/74122#M18628 sdaniels 2012-06-13T12:35:51Z https://community.splunk.com/t5/Splunk-Search/How-to-limit-my-search-to-return-only-the-top-10-results-based/m-p/74123#M18629 <P>But that's probably the most reasonable result for the question.</P> Wed, 13 Jun 2012 12:38:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-limit-my-search-to-return-only-the-top-10-results-based/m-p/74123#M18629 ziegfried 2012-06-13T12:38:20Z https://community.splunk.com/t5/Splunk-Search/How-to-limit-my-search-to-return-only-the-top-10-results-based/m-p/74124#M18630 <P>If you just want the greatest values and not the top 10 just sort it in descending order.</P> Wed, 13 Jun 2012 12:39:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-limit-my-search-to-return-only-the-top-10-results-based/m-p/74124#M18630 sdaniels 2012-06-13T12:39:17Z https://community.splunk.com/t5/Splunk-Search/How-to-limit-my-search-to-return-only-the-top-10-results-based/m-p/74125#M18631 <P>The question kind-of indicates the 10 greatest values.</P> Wed, 13 Jun 2012 12:40:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-limit-my-search-to-return-only-the-top-10-results-based/m-p/74125#M18631 ziegfried 2012-06-13T12:40:44Z https://community.splunk.com/t5/Splunk-Search/How-to-limit-my-search-to-return-only-the-top-10-results-based/m-p/74126#M18632 <P>I've slightly changed the search to do the "round" after the aggregation. This is better because it reduces the rounding error.</P> Wed, 13 Jun 2012 12:44:23 GMT https://community.splunk.com/t5/Splunk-Search/How-to-limit-my-search-to-return-only-the-top-10-results-based/m-p/74126#M18632 ziegfried 2012-06-13T12:44:23Z https://community.splunk.com/t5/Splunk-Search/How-to-limit-my-search-to-return-only-the-top-10-results-based/m-p/74127#M18633 <P>Thanks a lot for your replies.. "head" works ...</P> Thu, 14 Jun 2012 05:07:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-limit-my-search-to-return-only-the-top-10-results-based/m-p/74127#M18633 ranjyotiprakash 2012-06-14T05:07:52Z https://community.splunk.com/t5/Splunk-Search/How-to-limit-my-search-to-return-only-the-top-10-results-based/m-p/74128#M18634 <P>Why they have used sort - bandwidth there ..can u please explain me</P> Tue, 12 May 2015 05:29:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-limit-my-search-to-return-only-the-top-10-results-based/m-p/74128#M18634 SanthoshSreshta 2015-05-12T05:29:20Z https://community.splunk.com/t5/Splunk-Search/How-to-limit-my-search-to-return-only-the-top-10-results-based/m-p/74129#M18635 <P>from the docs about <CODE>sort</CODE> <A href="http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Sort">http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Sort</A> :</P> <PRE><CODE>Description: List of fields to sort by and their order, descending ( - ) or ascending ( + ). </CODE></PRE> Tue, 12 May 2015 05:33:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-limit-my-search-to-return-only-the-top-10-results-based/m-p/74129#M18635 MuS 2015-05-12T05:33:19Z https://community.splunk.com/t5/Splunk-Search/How-to-limit-my-search-to-return-only-the-top-10-results-based/m-p/74130#M18636 <P>yah.!!<BR /> Got it. Thank you. <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Tue, 12 May 2015 06:17:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-limit-my-search-to-return-only-the-top-10-results-based/m-p/74130#M18636 SanthoshSreshta 2015-05-12T06:17:01Z https://community.splunk.com/t5/Splunk-Search/How-to-limit-my-search-to-return-only-the-top-10-results-based/m-p/673539#M230637 <P>The usage of sort is fine if the number of items is not too large. To sort a large number of items is time consuming, and there is a limit in Splunk. Because of the limit, the attempt to sort the items and then to select the first 10 items might end in a wrong result.</P><P>In order to avoid this, I filter all items above/below a limit that is specific to the problem. For instance, 50 000 records are processed, more than 49 000 records are processed within 2 seconds, but there are a few records for which the processing takes more time. So I set the limit to 2 seconds.<BR />However, if there are just a few records, e.g., 10, then it might be the case that the list of Top 10 results is empty because all of them are below the limit of 2 seconds.</P> Mon, 08 Jan 2024 14:54:12 GMT https://community.splunk.com/t5/Splunk-Search/How-to-limit-my-search-to-return-only-the-top-10-results-based/m-p/673539#M230637 Konrad_Schlude 2024-01-08T14:54:12Z