How to show the Report to display the Top 10 Max values

[rajeswariramar]

Report to show the Top 10 Max values

I want the Report as below

IBD successcont Mintime Maxtime

IBD1 2 3000 11071

IBD2 2 2678 2265

etc

index=* sourcetype=VM_STATS ( Status=SUCCESS ) | stats count, max(TimeTaken) as max, MIN(TimeTaken) as MIN, avg(TimeTaken) as avg by IBD

i want to list the top 10 max values to be retrived....

can you please advice

[mayurr98]

hey try this!

index=* sourcetype=VM_STATS ( Status=SUCCESS ) | stats count, max(TimeTaken) as max, MIN(TimeTaken) as MIN, avg(TimeTaken) as avg by IBD | sort limit=10 max desc

you can use sort command and limit option to limit the number of top values!
Refer this doc.
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Sort#Description

Let me know if this helps you!

[harsmarvania57 · Accepted solution]

Hi,

Please try this

index=* sourcetype=VM_STATS ( Status=SUCCESS ) | stats count, max(TimeTaken) as max, MIN(TimeTaken) as MIN, avg(TimeTaken) as avg by IBD | sort 10 -max