How do I display top 10 values in the Trellis layout?

[ejohn]

Below is a sample from the end of my search:

...
|stats count by area, type
|sort -count

Using the Trellis layout, split on AREA, six pie charts counting by TYPE are returned. I’d like to display the Top 10 types for each area. If the top command can’t be used, how can I group anything over the first 10 results in an “other” pie segment?

[niketn · Accepted solution]

Hi @ejohn, I am not sure why you say top command can not be used. It is most ideal command to be used for this scenario. As per your description you should be using the following command:

<YourBaseSearch>
| top 10 area by type

Then use Trellis with Split by option as area from UI in Edit mode Or the following Simple XML configuration:

<option name="trellis.splitBy">area</option>

PS: In case you want something of reverse effect you can change to

<YourBaseSearch>
|top 10 type by area

Please try out and confirm.

[ejohn]

Hi @niketnilay. I knew top command was ideal, but I missed adding the by area portion in some attempts, and tried it in conjunction with stats count in others. The grouping portion of my question was just an alternative option for displaying the information, if anyone had ideas. There was a small typo in the solution you provided, but the following displayed exactly what I needed:

…|top limit=10 type by area

Thanks for the help!

[niketn]

Hi @ejohn, it is not type. Both | top 10 area by type and | top limit=10 area by type are the same. It is up to our convenience which one we choose.

In fact 10 is the default value for top so | top area by type should also give you same results. 🙂

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Top#Example_3:_Returns_the_top_pr...

[ejohn]

Oh... ok @niketnilay. I must have entered something wrong the first time, because no results were returning and it worked when I added the limit. I tried all three solutions today with success. Thanks again!