in panel set token for first, second and third result of top10 list to reuse in other panel search

[svp66]

In Dashboard studio i have a panel with a list of the top 10 issuetypes. I want to set 3 tokens with nr 1, 2 and 3 of this top 10 to use thes in a different panel search to show the (full) events.

index=.....      ("WARNING -" OR "ERROR -")
| rex field=_raw "(?<issuetype>\w+\s-\s\w+)\:"
| stats count by application, issuetype
| sort by -count
| head 10

The result depends and might be:

count issuetype
345 ERROR - Connectbus
235 Warning - Queries
76 Error - Export
45 Error - Client
32 Warning - Queue
…

Now i want to show the events of the top 3 issuetypes of this list in the following panels by storing the first 3 issuetypes in $tokenfirst$ $tokensecond$ and $tokenthird$ and searching for those values.

I selected use search result as token, but how do i select only the first 3 results in 3 different tokens (and of course after the top 10 is calculated )

[datadevops]

Hi there,

1. Isolate the Top 3:

• Add a dedup issuetype command after the head 10 to keep only unique issuetypes.
• Then, use head 3 to grab the first 3.

2. Create Individual Tokens:

• Use the fields command to extract each issuetype into a distinct field:

| fields issuetype1=issuetype issuetype2=issuetype issuetype3=issuetype

3. Assign Tokens:

• In the Token configuration, select "Use search result as token."
• Map issuetype1 to <span class="math-inline">tokenfirst</span>, issuetype2 to <span class="math-inline">tokensecond</span>, and issuetype3 to <span class="math-inline">tokenthird</span>.

Here's the full search string:

index=..... ("WARNING -" OR "ERROR -")
| rex field=_raw "(?<issuetype>\w+\s-\s\w+)\:"
| stats count by application, issuetype
| sort by -count
| head 10
| dedup issuetype
| head 3
| fields issuetype1=issuetype issuetype2=issuetype issuetype3=issuetype

Now you can use those tokens in your other panels to display events for the top 3 issuetypes!

Remember:

• Adjust the index and other search terms to match your specific data.
• If you encounter any issues, consult Splunk documentation or community forums for guidance.

~ If the reply helps, a Karma upvote would be appreciated