Archive
Highlighted

How to get top 10 values of a column and its raw data for each value

Loves-to-Learn Lots

index=omiUat host=DEFRNCMP* sourcetype=allevents_attributes | eval {idx} = elt | fields ID,UMN,TicketID,node | top limit=10 UMN

This is the query I'm trying to get top 10 UMN . How can I get field values of ID,TicketID,node for each UMN

Tags (1)
0 Karma
Highlighted

Re: How to get top 10 values of a column and its raw data for each value

Path Finder

I think you can do a join and then search again.

index=omiUat host=DEFRNCMP* sourcetype=alleventsattributes | eval {idx} = elt | fields ID,UMN,TicketID,node | top limit=10 UMN
| join UMN
[search index=omi
Uat host=DEFRNCMP* sourcetype=alleventsattributes | eval {idx} = elt | fields ID,UMN,TicketID,node]
| fields UMN ID TicketID node

0 Karma
Highlighted

Re: How to get top 10 values of a column and its raw data for each value

Loves-to-Learn Lots

Thanks . It worked 🙂

0 Karma
Highlighted

Re: How to get top 10 values of a column and its raw data for each value

Builder

You can manually perform the top command after a stats that pulls the latest _raw event using the below query:

index=omi_Uat host=DEFRNCMP* sourcetype=all_events_attributes 
| eval {idx} = elt 
| fields ID,UMN,TicketID,node 
| stats count values(ID) as ID values(TicketID) as TicketID values(node) as node by UMN
| eventstats sum(count) as TotalCount
| eval percent=round((count/TotalCount)*100,6)
| sort 0 - count
| streamstats count as counter
| where counter<=10
| fields - TotalCount counter

If you require an other field that will make it a bit tricker, but it is possible:

index=omi_Uat host=DEFRNCMP* sourcetype=all_events_attributes 
| eval {idx} = elt 
| fields ID,UMN,TicketID,node 
| stats count values(ID) as ID values(TicketID) as TicketID values(node) as node  by UMN
| eventstats sum(count) as TotalCount
| eval percent=round((count/TotalCount)*100,6)
| sort 0 - count
| streamstats count as counter
| eval UMN=if(counter>10, UMN, "Other")
| fields - TotalCount counter
| stats sum(count) as count sum(percent) as percent values(ID) as ID values(TicketID) as TicketID values(node) as node by UMN
| sort 0 - count
If this comment/answer was helpful, please up vote it. Thank you.
0 Karma
Highlighted

Re: How to get top 10 values of a column and its raw data for each value

Builder

Sorry, I misread the initial request and the first result was providing _raw values but you wanted specific fields. I have just adjusted it for that.

If this comment/answer was helpful, please up vote it. Thank you.
0 Karma
Highlighted

Re: How to get top 10 values of a column and its raw data for each value

Loves-to-Learn Lots

Thanks for your help.

0 Karma
Highlighted

Re: How to get top 10 values of a column and its raw data for each value

Builder

Glad I could help!

If this comment/answer was helpful, please up vote it. Thank you.
0 Karma