Splunk Search

How to calculate Top limit=10 OR head 10 not working by Count?

beriwalnishant
Path Finder

Hi Team

 

I have a query where I am doing the TimeChart & % (not using the timechart and calculate the % in timechart line as this doesn't solve my purpose hence using it this say)

The query is working fine however it shows all the data on field and I want to have that field only show top 10  by volume or count

Query 

index=xyz (catcode="*") (prodid="1") (prodcat="*") success="*"
| bucket _time span="1d"

| eval TheError=if(success="false" AND Error_Value like "%%",count,0)
| eval Success=if(success="true",count,0)
| stats sum(TheError) as "Failed", sum(Success) as "Passed", sum(count) as Total by _time, catcode
| eval Failed_Percent=round((Failed/Total)*100,2)
| fields _time, catcode, Failed_Percent
| xyseries _time, catcode, Failed_Percent




I don't want to do the 'eventstats' because it will count all on prodid level and not at catcode level hence this query
This query counts all false with error on catcode....and count all attempts on individual catcode, then calculate the %
with event stats the total count will be not at catcode but all prodid count i.e. all catcode's total attempt's count

 

Thanks in advance

 

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

To show only the 10 results with the highest values of Failed_Percent you can use the sort command.

...
| xyseries _time, catcode, Failed_Percent
| sort 10 - Failed_Percent

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

At this point in your search:

index=xyz (catcode="*") (prodid="1") (prodcat="*") success="*"
| bucket _time span="1d"

| eval TheError=if(success="false" AND Error_Value like "%%",count,0)
| eval Success=if(success="true",count,0)
| stats sum(TheError) as "Failed", sum(Success) as "Passed", sum(count) as Total by _time, catcode

you have 5 fields, _time, catcode, Failed, Passed and Total.

Where does prodId come from?

If you use eventstats at this point, you can sum the Total to find count all the events by catcode.

index=xyz (catcode="*") (prodid="1") (prodcat="*") success="*"
| bucket _time span="1d"

| eval TheError=if(success="false" AND Error_Value like "%%",count,0)
| eval Success=if(success="true",count,0)
| stats sum(TheError) as "Failed", sum(Success) as "Passed", sum(count) as Total by _time, catcode
| eventstats sum(Total) as Total_catcode by catcode

Does that help you? If not, please explain with some examples of what you are currently have and what you would like to see

0 Karma

richgalloway
SplunkTrust
SplunkTrust

To show only the 10 results with the highest values of Failed_Percent you can use the sort command.

...
| xyseries _time, catcode, Failed_Percent
| sort 10 - Failed_Percent

 

---
If this reply helps you, Karma would be appreciated.

beriwalnishant
Path Finder

This only sorts the time and instead of 10 showing single column of catcode...the one is hihest

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...