Splunk Search

How can I filter the top / head values by a summed field (e.g. day)?

markmcd
Path Finder

I have a search that returns the number of 'views' of a product by day using a 'search xyz |bucket _time span=1d |stats sum(product_views) by _time,product_name' search.

I'd like to limit the search to the top 10 products by total views each day. How can I do this?

If I could add a 'rank' field by day, I'd be able to use a where clause but I can't figure out how to do that.

Tags (4)
0 Karma

kristian_kolb
Ultra Champion

Could this work for you?

search xyz | top 10 product_name by date_mday

or you can bucket _time before top and use by _time

UPDATE:

what about

... | timechart per_day(product_view) by product_name limit=10 useother=false

UPDATE:

... | bucket span=1d _time | eventstats sum(product_view) as sum_views by product_name, _time | top 10 sum_views by _time 

/k

kristian_kolb
Ultra Champion

better. just check to see that the figures are correct. /k

0 Karma

markmcd
Path Finder

Cool... I'm getting closer! I apologise for not being clearer in the question, but I'm looking to get the top 10 for each day, not top 10 overall counted by each day. So I'd expect 10 rows for today, 10 for yesterday, 10 for the day before where each of the 'product_name' values could be different.

0 Karma

kristian_kolb
Ultra Champion

see update /k

0 Karma

markmcd
Path Finder

Because I've got a stats 'sum' function in my query I don't think I can use top as it performs a 'count'. Every row/tuple only occurs once in the results sent to top (it's partially aggregated when it's ingested unfortunately).

0 Karma
Get Updates on the Splunk Community!

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...