Splunk Search

How can I filter the top / head values by a summed field (e.g. day)?

Path Finder

I have a search that returns the number of 'views' of a product by day using a 'search xyz |bucket time span=1d |stats sum(productviews) by time,productname' search.

I'd like to limit the search to the top 10 products by total views each day. How can I do this?

If I could add a 'rank' field by day, I'd be able to use a where clause but I can't figure out how to do that.

Tags (4)
0 Karma

Ultra Champion

Could this work for you?

search xyz | top 10 product_name by date_mday

or you can bucket _time before top and use by _time

UPDATE:

what about

... | timechart per_day(product_view) by product_name limit=10 useother=false

UPDATE:

... | bucket span=1d _time | eventstats sum(product_view) as sum_views by product_name, _time | top 10 sum_views by _time 

/k

Ultra Champion

better. just check to see that the figures are correct. /k

0 Karma

Path Finder

Cool... I'm getting closer! I apologise for not being clearer in the question, but I'm looking to get the top 10 for each day, not top 10 overall counted by each day. So I'd expect 10 rows for today, 10 for yesterday, 10 for the day before where each of the 'product_name' values could be different.

0 Karma

Ultra Champion

see update /k

0 Karma

Path Finder

Because I've got a stats 'sum' function in my query I don't think I can use top as it performs a 'count'. Every row/tuple only occurs once in the results sent to top (it's partially aggregated when it's ingested unfortunately).

0 Karma