topic Re: Using eval to Add Field for top Result in Splunk Search

Using eval to Add Field for top Result?

splunkyphil — Mon, 24 Oct 2022 13:21:52 GMT

I need to create a new field to assign to the top results of a command using eval.

Obviously this syntax doesn't work, so I'm looking for the correct query:

source="tutorialdata.zip*" | eval popular = top limit=5 itemId | stats count(action) by popular, action

Basically I only need the action stats of the top 5 itemId results of the following:

Sorry for the n00b question; I am just getting started with Splunk. Thanks for your time!

Re: Using eval to Add Field for top Result

bowesmana — Mon, 24 Oct 2022 00:41:27 GMT

Is this what you're after?

source="tutorialdata.zip*" | eval X_{action}=action | stats count as total count(X_*) as X_* by itemId | sort - total | head 5 | rename X_* as * | fields - total

That will give you 5 rows of the most frequent itemId and then each column is a count of actions

Note the X_ prefix to the new field created is to allow the use of wildcards in the stats command to only collect the fields you're interested in.

You could also replace the eval/stats with

| eval X_{action}=1 | stats count as total sum(X_*) as X_* by itemId

which may be slightly more efficient

Re: Using eval to Add Field for top Result

splunkyphil — Mon, 24 Oct 2022 04:05:01 GMT

This works; thank you kindly!