Splunk Search

Help with search to show the top 5 results

Hppjet
Path Finder
index="all_eqt" Plant=15 ProcessCode=T DefectCode="*" MachineNumber<26 | stats sum(TotalSquareYards) as "Total Square Yards" by StyleName | sortStyleName

I'm trying to limit the data shown on the chart to the top 5 styles with the highest TotalSquareYards

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

This should do it.

index="all_eqt" Plant=15 ProcessCode=T DefectCode="*" MachineNumber<26 | stats sum(TotalSquareYards) as "Total Square Yards" by StyleName | top 5 "Total Square Yards" by StyleName | sort StyleName
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

This should do it.

index="all_eqt" Plant=15 ProcessCode=T DefectCode="*" MachineNumber<26 | stats sum(TotalSquareYards) as "Total Square Yards" by StyleName | top 5 "Total Square Yards" by StyleName | sort StyleName
---
If this reply helps you, Karma would be appreciated.
0 Karma

DalJeanis
Legend

| top is problematic here. it's really designed only to count the occurrences of the field values and give the values themselves. The by StyleName will give you the top 5 of each Stylename, which won't help, since only one record exists for each StyleName, it's not limiting anything.

Two options...

| sort - "Total Square Yards" 
| head 5

...or more succinctly...

| sort 5 - "Total Square Yards" 
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...