topic Re: How to limit search results to * % of all results in Splunk Search

How to limit search results to * % of all results

kk2204 — Wed, 08 Nov 2023 14:02:24 GMT

I've got a search query which outputs 175 rows. I want it to output only top 5%. The row count will change over time so I cannot set a fixed int value. It needs to be dynamic.

Re: How to limit search results to * % of all results

FelixLeh — Wed, 08 Nov 2023 14:36:19 GMT

You can either use the top command (https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Top)

| top <your_field> limit=<your_choice>

OR
you can use sort and the use head

| sort - count | head <number_of_choice>

If this is inside a dashboard you could create a token based on the amount of search results and input it as the number for head or top command.

Re: How to limit search results to * % of all results

kk2204 — Wed, 08 Nov 2023 14:38:19 GMT

I know that but with your solution I can only use integers such as 5,1,10 etc. I want to limit the results to a certain percentage of all possible results.

Re: How to limit search results to * % of all results

PickleRick — Wed, 08 Nov 2023 14:42:03 GMT

<yoursearch>
| evenstats count as total
| streamstats count as current
| where current<=0.15*total

Re: How to limit search results to * % of all results

FelixLeh — Wed, 08 Nov 2023 14:47:58 GMT

Great Solution!
But there was a typo and it disregarded the amount of count.
Added a sort to your solution.

Re: How to limit search results to * % of all results

PickleRick — Wed, 08 Nov 2023 14:54:42 GMT

What is your way of sorting, groupping, ordering and so on is up to you. 🙂

"My" part only did the limiting.

Re: How to limit search results to * % of all results

kk2204 — Wed, 08 Nov 2023 15:21:02 GMT

Thanks both of you guys!