topic sort after limit row? in Splunk Search

sort after limit row?

chengyu — Wed, 19 Mar 2014 05:12:26 GMT

Hi:

I'hope sort after limit row, i try head or sort limit or top...but fail, what can i do?
Thank you

sourcetype=xxx |eval bandwidth=rcvdbyte+sentbyte | eval bandwidth(MB) = round(bandwidth/1024/1024,2) | stats list(dstip) as dstip values(app) as app values(hostname) as hostname sum(bandwidth(MB)) as bandwidth(MB) by srcip|  table srcip,dstip,app,hostname bandwidth(MB)|sort bandwidth(MB) desc

now:

srcip dstip ... bandwidth(MB)
1.1.1.1 2.2.2.2 5
3.3.3.3 5
4.4.4.4 5
....
10.10.10.10

hope modify to dstip limit 3:

srcip dstip ... bandwidth(MB)
1.1.1.1 2.2.2.2 5
3.3.3.3 5
4.4.4.4 5

Re: sort after limit row?

lguinn2 — Wed, 19 Mar 2014 07:38:53 GMT

I am not sure exactly what you want here, but you have some errors in your search. First ( is not a valid character in a field name, unless you enclose it in quotation marks (sometimes double quotes and sometimes single quotes). So I suggest that you use a different field name like bandwidthMB to avoid this problem.

sourcetype=xxx 
|eval bandwidth=rcvdbyte+sentbyte 
| eval bandwidthMB = round(bandwidth/1024/1024,2) 
| stats list(dstip) as dstip values(app) as app values(hostname) as hostname sum(bandwidthMB) as bandwidthMB by srcip
| sort  10 -bandwidthMB

By adding the 10 into the sort command, you will only see the top 10 values of bandwidthMB

If you only want to see the top 3 values of dstip, you can do this:

sourcetype=xxx 
| eval bandwidthMB=round((rcvdbyte+sentbyte )/1024/1024,2) 
| stats count sum(bandwidthMB) as bandwidthMB by dstip app hostname srcip
| sort srcip -count
| stats list(dstip) as dstip values(app) as app values(hostname) as hostname sum(bandwidthMB) as bandwidthMB by srcip
| eval dstipList = mvjoin(dstip,";")
| eval dstipList = replace(dstipList,"^(.+?;.+?;.+?);.*","\1")
| eval dstip=split(dstipList,";")
| fields - dstipList
| sort 10 -bandwidthMB

Re: sort after limit row?

chengyu — Wed, 19 Mar 2014 08:31:49 GMT

Thank you so much.