Splunk Search

How do I return only 5 ACCOUNT_IDs from my "chart list(ACCOUNT_ID) by script" search?

ARTHI
Engager
chart list(ACCOUNT_ID) by script  

I am getting a chart with script and list of ACCOUNT_ID. I want only 5 ACCOUNT_ID'S in the list. I tried the limit parameter and head command, but could not get the expected result.

Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Your question could do with a few more details, so I'll hazard a guess:

... | top 0 ACCOUNT_ID script | streamstats count by script | where count <= 5 | stats values(ACCOUNT_ID) by script

That's assuming you want the most frequent five accounts.

If you just want to truncate the lists you already have, you could use the eval function mvindex(field, start, end)to do that after your chart command.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Your question could do with a few more details, so I'll hazard a guess:

... | top 0 ACCOUNT_ID script | streamstats count by script | where count <= 5 | stats values(ACCOUNT_ID) by script

That's assuming you want the most frequent five accounts.

If you just want to truncate the lists you already have, you could use the eval function mvindex(field, start, end)to do that after your chart command.

ARTHI
Engager

Thanks martin...
I am able to get the most frequent 5 accounts...
What if the Chart has two List like chart list(ACCOUNT_ID), list(institute) by script and I have to restrict the count only for list of ACCOUNT_ID.....above mentioned solution is not wrking

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

That depends on the requirements. Is that a list of insitutes per account, for those five accounts, for all accounts, ...?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...