Splunk Search

How do I return only 5 ACCOUNT_IDs from my "chart list(ACCOUNT_ID) by script" search?

ARTHI
Engager
chart list(ACCOUNT_ID) by script  

I am getting a chart with script and list of ACCOUNT_ID. I want only 5 ACCOUNT_ID'S in the list. I tried the limit parameter and head command, but could not get the expected result.

Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Your question could do with a few more details, so I'll hazard a guess:

... | top 0 ACCOUNT_ID script | streamstats count by script | where count <= 5 | stats values(ACCOUNT_ID) by script

That's assuming you want the most frequent five accounts.

If you just want to truncate the lists you already have, you could use the eval function mvindex(field, start, end)to do that after your chart command.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Your question could do with a few more details, so I'll hazard a guess:

... | top 0 ACCOUNT_ID script | streamstats count by script | where count <= 5 | stats values(ACCOUNT_ID) by script

That's assuming you want the most frequent five accounts.

If you just want to truncate the lists you already have, you could use the eval function mvindex(field, start, end)to do that after your chart command.

ARTHI
Engager

Thanks martin...
I am able to get the most frequent 5 accounts...
What if the Chart has two List like chart list(ACCOUNT_ID), list(institute) by script and I have to restrict the count only for list of ACCOUNT_ID.....above mentioned solution is not wrking

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

That depends on the requirements. Is that a list of insitutes per account, for those five accounts, for all accounts, ...?

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...