topic Re: Top results for multiseries data in Splunk Search

Top results for multiseries data

tcollyer — Mon, 28 Sep 2020 15:55:32 GMT

Hi there,

I'm charting multiseries data displayed in stacked columns with the following command:

stats dc(Process_Name) by
hostname,Company | xyseries
hostname,Company,dc(Process_Name)

This works fine, except for the fact that I now have over 5000 hosts (i.e. values for 'hostname') and I need a way to quickly display only the ones with the most number of processes (i.e. discrete values of 'Process_Name'). If I could make it work, something like 'top' or 'head' would be great:

stats dc(Process_Name) as processes by
hostname,Company|sort
hostname,-processes|head 50|xyseries
hostname,Company,processes

The sort command seems to provide unpredictable results though when it is preceded by a multi-value command (e.g. the B,C in 'stats(A) by B,C'). Can anyone offer me a way to view just the top 50 (or whatever) hosts when sorted by the number of processes?

Thanks for the help.

Re: Top results for multiseries data

somesoni2 — Tue, 18 Feb 2014 22:26:37 GMT

Try this

your base search | stats dc(Process_Name) by hostname,Company | sort hostname,-dc(Process_Name) | streamstats count by hostname | where count < 51 |xyseries hostname,Company,processes

Re: Top results for multiseries data

tcollyer — Wed, 19 Feb 2014 20:02:07 GMT

Thanks for your suggestion. It gave me a number of things to try out and poke at, none of which worked unfortunately.

As far as I can tell, after I call "stats dc(Process_Name) by hostname,Company", everything has already been sorted by hostname and other attempts to reorder the data yield strange results. For instance, this:

base search | stats dc(Process_Name) by hostname,Company | sort -hostname | xyseries hostname,Company,dc(Process_Name)

gives sorts the hosts starting at 328 and goes up from there instead of starting at 1.

Streamstats seemed to have no effect at all. Other ideas?