Splunk Search

Help with search to show the top 5 results

Path Finder
index="all_eqt" Plant=15 ProcessCode=T DefectCode="*" MachineNumber<26 | stats sum(TotalSquareYards) as "Total Square Yards" by StyleName | sortStyleName

I'm trying to limit the data shown on the chart to the top 5 styles with the highest TotalSquareYards

0 Karma
1 Solution

SplunkTrust
SplunkTrust

This should do it.

index="all_eqt" Plant=15 ProcessCode=T DefectCode="*" MachineNumber<26 | stats sum(TotalSquareYards) as "Total Square Yards" by StyleName | top 5 "Total Square Yards" by StyleName | sort StyleName
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

This should do it.

index="all_eqt" Plant=15 ProcessCode=T DefectCode="*" MachineNumber<26 | stats sum(TotalSquareYards) as "Total Square Yards" by StyleName | top 5 "Total Square Yards" by StyleName | sort StyleName
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

| top is problematic here. it's really designed only to count the occurrences of the field values and give the values themselves. The by StyleName will give you the top 5 of each Stylename, which won't help, since only one record exists for each StyleName, it's not limiting anything.

Two options...

| sort - "Total Square Yards" 
| head 5

...or more succinctly...

| sort 5 - "Total Square Yards" 
0 Karma