Splunk Enterprise

Top n plus others

lpolo
Motivator

Let's say we have the following log events:

time1 text=g  count=82
time2 text=f  count=80
time3 text=c  count=14
time4 text=e  count=13
time5 text=b  count=11
time6 text=a  count=10
time7 text=d  count=6

The following query will get the Top N results:

earliest=time1 latest=time7 index=blabla |
stat sum(count) as count by text

Result:
text | count
g   82
f   80
c  14
e  13
b  11
a  10
d  6

I need a query to get the Top 3 plus others result example:

text | count
g   82
f   80
c  14
others 40

Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

See if this helps.

| makeresults | eval data="time1 text=g  count=82|time2 text=f  count=80|time3 text=c  count=14|time4 text=e  count=13|time5 text=b  count=11|time6 text=a  count=10|time7 text=d  count=6" | eval data=split(data,"|") | mvexpand data | eval _raw=data | extract pairdelim=" " kvdelim="="
`comment("Above just sets up test data")`
`comment("Get the top 3 counts and put everything else in 'other'")`
| timechart span=1d limit=3 useother=t sum(count) as count by text
`comment("Throw out fields we don't need")`
| fields - _*
`comment("Rotate the results")`
| transpose column_name="text" header_field=count
| rename "row 1" as count
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

See if this helps.

| makeresults | eval data="time1 text=g  count=82|time2 text=f  count=80|time3 text=c  count=14|time4 text=e  count=13|time5 text=b  count=11|time6 text=a  count=10|time7 text=d  count=6" | eval data=split(data,"|") | mvexpand data | eval _raw=data | extract pairdelim=" " kvdelim="="
`comment("Above just sets up test data")`
`comment("Get the top 3 counts and put everything else in 'other'")`
| timechart span=1d limit=3 useother=t sum(count) as count by text
`comment("Throw out fields we don't need")`
| fields - _*
`comment("Rotate the results")`
| transpose column_name="text" header_field=count
| rename "row 1" as count
---
If this reply helps you, Karma would be appreciated.
0 Karma

lpolo
Motivator

Hi,
Thanks for your response. I forgot about the limit=n in the timechart command. Thanks 🙂
To complement your response I just added this after the timeshare command

| timechart span=1d limit=1000 sum(count) by text 
| transpose
| search NOT column=_span NOT column=_time
| rename "row 1" as count
| sort - count

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...