Splunk Enterprise

Top n plus others

lpolo
Motivator

Let's say we have the following log events:

time1 text=g  count=82
time2 text=f  count=80
time3 text=c  count=14
time4 text=e  count=13
time5 text=b  count=11
time6 text=a  count=10
time7 text=d  count=6

The following query will get the Top N results:

earliest=time1 latest=time7 index=blabla |
stat sum(count) as count by text

Result:
text | count
g   82
f   80
c  14
e  13
b  11
a  10
d  6

I need a query to get the Top 3 plus others result example:

text | count
g   82
f   80
c  14
others 40

Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

See if this helps.

| makeresults | eval data="time1 text=g  count=82|time2 text=f  count=80|time3 text=c  count=14|time4 text=e  count=13|time5 text=b  count=11|time6 text=a  count=10|time7 text=d  count=6" | eval data=split(data,"|") | mvexpand data | eval _raw=data | extract pairdelim=" " kvdelim="="
`comment("Above just sets up test data")`
`comment("Get the top 3 counts and put everything else in 'other'")`
| timechart span=1d limit=3 useother=t sum(count) as count by text
`comment("Throw out fields we don't need")`
| fields - _*
`comment("Rotate the results")`
| transpose column_name="text" header_field=count
| rename "row 1" as count
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

See if this helps.

| makeresults | eval data="time1 text=g  count=82|time2 text=f  count=80|time3 text=c  count=14|time4 text=e  count=13|time5 text=b  count=11|time6 text=a  count=10|time7 text=d  count=6" | eval data=split(data,"|") | mvexpand data | eval _raw=data | extract pairdelim=" " kvdelim="="
`comment("Above just sets up test data")`
`comment("Get the top 3 counts and put everything else in 'other'")`
| timechart span=1d limit=3 useother=t sum(count) as count by text
`comment("Throw out fields we don't need")`
| fields - _*
`comment("Rotate the results")`
| transpose column_name="text" header_field=count
| rename "row 1" as count
---
If this reply helps you, Karma would be appreciated.
0 Karma

lpolo
Motivator

Hi,
Thanks for your response. I forgot about the limit=n in the timechart command. Thanks 🙂
To complement your response I just added this after the timeshare command

| timechart span=1d limit=1000 sum(count) by text 
| transpose
| search NOT column=_span NOT column=_time
| rename "row 1" as count
| sort - count

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...