Splunk Search

How can I filter the top / head values by a summed field (e.g. day)?

markmcd
Path Finder

I have a search that returns the number of 'views' of a product by day using a 'search xyz |bucket _time span=1d |stats sum(product_views) by _time,product_name' search.

I'd like to limit the search to the top 10 products by total views each day. How can I do this?

If I could add a 'rank' field by day, I'd be able to use a where clause but I can't figure out how to do that.

Tags (4)
0 Karma

kristian_kolb
Ultra Champion

Could this work for you?

search xyz | top 10 product_name by date_mday

or you can bucket _time before top and use by _time

UPDATE:

what about

... | timechart per_day(product_view) by product_name limit=10 useother=false

UPDATE:

... | bucket span=1d _time | eventstats sum(product_view) as sum_views by product_name, _time | top 10 sum_views by _time 

/k

kristian_kolb
Ultra Champion

better. just check to see that the figures are correct. /k

0 Karma

markmcd
Path Finder

Cool... I'm getting closer! I apologise for not being clearer in the question, but I'm looking to get the top 10 for each day, not top 10 overall counted by each day. So I'd expect 10 rows for today, 10 for yesterday, 10 for the day before where each of the 'product_name' values could be different.

0 Karma

kristian_kolb
Ultra Champion

see update /k

0 Karma

markmcd
Path Finder

Because I've got a stats 'sum' function in my query I don't think I can use top as it performs a 'count'. Every row/tuple only occurs once in the results sent to top (it's partially aggregated when it's ingested unfortunately).

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...