Splunk Search

How do I get top values based on eval?

jackpal
Path Finder

I have a relatively simple query with which I am evaluating a new field. I'd like to get the top values of this new field however the results are not what I expect:

Base Query:
index=lisum_data vendord=*  user_hash=* featurename=*  
| stats count by user_hash
| eval TimeUsed=count*10/60
| where TimeUsed > .5
| sort TimeUsed desc
| fields - count

Attempted:
index=lisum_data vendord=*  user_hash=* featurename=*  
| stats count by user_hash
| eval TimeUsed=count*10/60
| where TimeUsed > .5
| sort TimeUsed desc
| fields - count
| top limit=25 TimeUsed

I want a table of the top 25 users (user_hash) by total time used(TimeUsed)

0 Karma

KailA
Contributor

Hey !
You were really closed, try that :

index=lisum_data vendord=*  user_hash=* featurename=*  
 | stats count by user_hash
 | eval TimeUsed=count*10/60
 | where TimeUsed > .5
 | sort 25 -TimeUsed
 | fields - count

Let me know 🙂

Kail

0 Karma

Vijeta
Influencer

Your sort command should be sort 0 - TimeUsed

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...