Splunk Search

How to append search result with top 100 results?

seva98
Path Finder

I will try to explain my issue in the easiest possible way.

I have a result of a search that looks like this:

name1, name2, size
A      A      25
A      B      25
A      C      25
B      B      18
C      C      15
C      D      15

In the real project, the search is more complex but it follow this logic: A can have multiple B and always have the size of A.

I will need to retrieve the top 100 sizes but as this example is short, I would love to get the top 2 sizes and keep data from all other columns.

name1, name2, size
A      A      25
A      B      25
A      C      25
B      B      18

I really don't want to append this search with subsearch as search leading to this data is already very complex and takes a lot of time.
Is there any simple trick on how to achieve this?

Tags (4)
0 Karma
1 Solution

seva98
Path Finder

Fixed it, thanks to @renjith.nair explanation. His solution just had issue for data where multiple name1 can have same size. There may be some extra unnecessary code but it works.

Sorting is done first so I get the biggest nodes at the top.
Then I cut the list to desired size (97 in this case)
Then I am looking if name1 is in filteredList.

| eval parent=if(name1=name2, 1, 0)
| sort name
| sort -size
| sort -parent
| eventstats list(name1) as uniquelist
| eval filteredlist=mvindex(uniquelist, 0, 96)
| eval find_match = if(match(name1, filteredlist), 1, 0)
| where name1=filteredlist
| fields - filteredlist, uniquelist

View solution in original post

0 Karma

seva98
Path Finder

Fixed it, thanks to @renjith.nair explanation. His solution just had issue for data where multiple name1 can have same size. There may be some extra unnecessary code but it works.

Sorting is done first so I get the biggest nodes at the top.
Then I cut the list to desired size (97 in this case)
Then I am looking if name1 is in filteredList.

| eval parent=if(name1=name2, 1, 0)
| sort name
| sort -size
| sort -parent
| eventstats list(name1) as uniquelist
| eval filteredlist=mvindex(uniquelist, 0, 96)
| eval find_match = if(match(name1, filteredlist), 1, 0)
| where name1=filteredlist
| fields - filteredlist, uniquelist

View solution in original post

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@seva98,

Give this a try

"your search"|sort - size|eventstats list(size) size_list|eval size_list=mvdedup(size_list)
|eval hundredth=mvindex(size_list,99)
|where size >=hundredth | fields - size_list,hundredth

seva98
Path Finder

Almost, I have another issue when two different name1 have the same size for example name1=D => size=10, name1=E => size=10. Unfortunatelly mvdedup count them as one.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!