topic How to calculate Top limit=10 OR head 10 not working by Count? in Splunk Search

How to calculate Top limit=10 OR head 10 not working by Count?

beriwalnishant — Tue, 19 Jul 2022 16:04:02 GMT

Hi Team

I have a query where I am doing the TimeChart & % (not using the timechart and calculate the % in timechart line as this doesn't solve my purpose hence using it this say)

The query is working fine however it shows all the data on field and I want to have that field only show top 10 by volume or count

Query

index=xyz (catcode="*") (prodid="1") (prodcat="*") success="*" | bucket _time span="1d" | eval TheError=if(success="false" AND Error_Value like "%%",count,0) | eval Success=if(success="true",count,0) | stats sum(TheError) as "Failed", sum(Success) as "Passed", sum(count) as Total by _time, catcode | eval Failed_Percent=round((Failed/Total)*100,2) | fields _time, catcode, Failed_Percent | xyseries _time, catcode, Failed_Percent

I don't want to do the 'eventstats' because it will count all on prodid level and not at catcode level hence this query
This query counts all false with error on catcode....and count all attempts on individual catcode, then calculate the %
with event stats the total count will be not at catcode but all prodid count i.e. all catcode's total attempt's count

Thanks in advance

Re: Top limit=10 OR head 10 not working by Count

richgalloway — Tue, 19 Jul 2022 15:47:49 GMT

To show only the 10 results with the highest values of Failed_Percent you can use the sort command.

... | xyseries _time, catcode, Failed_Percent | sort 10 - Failed_Percent

Re: Top limit=10 OR head 10 not working by Count

ITWhisperer — Tue, 19 Jul 2022 15:52:19 GMT

At this point in your search:

you have 5 fields, _time, catcode, Failed, Passed and Total.

Where does prodId come from?

If you use eventstats at this point, you can sum the Total to find count all the events by catcode.

Does that help you? If not, please explain with some examples of what you are currently have and what you would like to see

Re: Top limit=10 OR head 10 not working by Count

beriwalnishant — Wed, 20 Jul 2022 03:57:45 GMT

This only sorts the time and instead of 10 showing single column of catcode...the one is hihest