topic Re: Limit to first 10 counts in Splunk Search

Limit to first 10 counts

Rajaion — Tue, 02 Jan 2024 13:57:29 GMT

Hello community,

I am having a problem displaying a graph. I have an index that contains incidents from several monitoring tools. I need to pull up a top 10 of the most recurring alerts (that's done).

However, on this top 10, I am asked for a graph to show the evolution of the number of errors in this top per week (in order to see for example when a fix has been deployed). And this is where I encounter a problem: in my query, I have my top 10 but I have an OTHER which brings together everything that is after the top 10:

Here is the query that causes this graph:

I tried to use "head" or "top" to force the display of the first 10 results only but in the case of "head", it doesn't change anything, and in the case of "top", my screen remains empty.
I've searched the forum and it's often these two answers that come up but in my case, it doesn't work. Do you know how to remove the OTHER to only have the first 10 results in my graph?

Sincerely,

Rajaion

Re: Limit to first 10 counts

dtburrows3 — Tue, 02 Jan 2024 14:03:29 GMT

You can try

| timechart span=1w useother=false limit=10 count by Service

This should limit to only the top 10 and also discard any events that don't fall into the top 10.

Re: Limit to first 10 counts

Rajaion — Tue, 02 Jan 2024 14:07:09 GMT

Hello @dtburrows3,

I didn't know about this "useother" option, and it works, it's exactly what I was looking for:

Thank you very much for your help.

Sincerely,

Lionel M.

Re: Limit to first 10 counts

CJ117 — Tue, 21 Jan 2025 22:48:44 GMT

How can this be used to find the last 10 events in chronological order?