topic Re: How to sort a report to give me top 20 MAX values? in Splunk Search

How to sort a report to give me top 20 MAX values?

sraguan — Mon, 28 Sep 2020 19:53:54 GMT

I have a report that showing me the top 20 of field called "sc_bytes" (By count),

> > source="xap.csv" | top limit=20 sc_bytes

So this is what I get:

sc_bytes cs_uri_stem Count percent
992 /messagebroker/amfpolling.wlforward 433769 16.32443
1245 /messagebroker/amfpolling.wlforward 72714 14.026691
276 /messagebroker/amfpolling.wlforward 217028 8.167615
927 /messagebroker/amfpolling.wlforward 119193 4.4857

but I want to see the top 20 of field called "sc_bytes" By the MAXIMUM value of the field itself and not by count.
So it will look like this:

sc_bytes cs_uri_stem Count percent
1245 /messagebroker/amfpolling.wlforward 72714 14.026691
992 /messagebroker/amfpolling.wlforward 433769 16.32443
927 /messagebroker/amfpolling.wlforward 119193 4.4857
276 /messagebroker/amfpolling.wlforward 217028 8.167615

Re: How to sort a report to give me top 20 MAX values?

richgalloway — Wed, 13 May 2015 18:00:27 GMT

It looks like your second example is just a re-sort of your first example. If that's all you need then add a sort to your search: source="xap.csv" | top limit=20 sc_bytes | sort -sc_bytes

Re: How to sort a report to give me top 20 MAX values?

sraguan — Thu, 14 May 2015 07:12:21 GMT

Thanks @richgalloway ,
the sort really did sorted the top 20 but I have 2 million events in this search and he sorted the top 20 that had the highest count.
I want to sort the top 20 events that has the highest (MAX) sc_bytes.

Re: How to sort a report to give me top 20 MAX values?

esix_splunk — Thu, 14 May 2015 08:15:57 GMT

This perhaps?

.... | stats count max(sc_bytes) as max | top limit=20 max

Re: How to sort a report to give me top 20 MAX values?

sraguan — Thu, 14 May 2015 08:33:07 GMT

@esix_splunk,
I tried what you suggested but stat max only give you 1 value which is the highest one,
it can't give you multiple values (20) like I want.

Re: How to sort a report to give me top 20 MAX values?

esix_splunk — Thu, 14 May 2015 08:41:04 GMT

Yes, need to group this by something. Such as host, interface, etc..

Re: How to sort a report to give me top 20 MAX values?

sraguan — Thu, 14 May 2015 08:51:02 GMT

I'm not sure i'm getting what you are saying (newbie in splunk),
is there a group command?
or even better - can you please write the search query that can give me the output that I want?

Re: How to sort a report to give me top 20 MAX values?

sraguan — Thu, 14 May 2015 11:10:04 GMT

got it:

source="xap.csv"  | fields sc_bytes | sort -sc_bytes  | head 20| top limit=20 sc_bytes