topic Re: How to get only first 3 events as a result for each event/Field? in Splunk Search

How to get only first 3 events as a result for each event/Field?

thezero — Tue, 28 Oct 2014 02:04:27 GMT

I am attempting to get first 3 events for each user field for which user count>3.

Basically what I am looking for is

1)Get stats count for user field out of all data

2)Identify events for which user count>3

3)Get only top 3 users out of all data for - user count>3

4)and final result which display only first 3 events for each user

for below query I am getting user count and top 3 users with max count.

index=windows | stats count by user | sort - count | head 3 |where count>3

result:

User count

User1 8
user2 4
user3 6

I want final result as 9 events---->containing first 3 events for each user.

Could you please advice?

Re: How to get only first 3 events as a result for each event/Field?

0YAoNnmRmKDg — Tue, 28 Oct 2014 02:31:10 GMT

try this

index=windows | stats count by user | where count>3 | top 3

otherwise try expanding your question a bit - its a little hard to follow...

Re: How to get only first 3 events as a result for each event/Field?

gkanapathy — Tue, 28 Oct 2014 02:51:54 GMT

index=windows | top limit=3 user | where count > 3

Re: How to get only first 3 events as a result for each event/Field?

davebrooking — Tue, 28 Oct 2014 10:40:46 GMT

I think the streamstats command is what you may need to use to rank the events - take a look at this answer, I believe it should point you in the right direction

Dave

Re: How to get only first 3 events as a result for each event/Field?

Jeff_Lightly_Sp — Tue, 28 Oct 2014 14:27:22 GMT

Does this get close to what you need? i just used 'eventtype' as an example.

index=windows | stats count by user,eventtype | sort - user,eventtype | where count > 3 | top limit=3 eventtype by user

Re: How to get only first 3 events as a result for each event/Field?

gkanapathy — Tue, 28 Oct 2014 14:28:35 GMT

Ah I see you've modified your question. Then perhaps:

index=windows [ search index=windows | top limit=3 showperc=f user | where count > 3 ] | eventstats count by user | dedup 3 user sortby - count

Re: How to get only first 3 events as a result for each event/Field?

thezero — Mon, 10 Nov 2014 08:24:43 GMT

H Gkanapathy,

Thanks for the asnswer but its still showing only 3 results 😞

Regards,
Rahul

Re: How to get only first 3 events as a result for each event/Field?

jitsinha — Mon, 10 Nov 2014 10:36:48 GMT

try | head 3 after your search query