- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How to control the number of top results shown fro...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am trying to control how many of the top results are shown.
I have the following search
stats max(c1693801001) as MaxCPU by measObjLdn | sort - MaxCPU
which gives me the following in the stats view:
measObjLdn MaxCPU
Object1 13
Object2 11
Object3 8
Object4 7
Object5 4
Object6 4
Object7 3
Object8 3
How do i just show the top 3 that would look like
measObjLdn MaxCPU
Object1 13
Object2 11
Object3 8
I have tried top but no joy, it just keeps showing them all
....| top limit=5 showcount=f showperc=f MaxCPU by measObjLdn | sort - MaxCPU
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Just change to:
stats max(c1693801001) as MaxCPU by measObjLdn | sort 3 - MaxCPU
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That is because you have a by clause so it is showing you the top 5 MaxCPU for each measObjLdn. You should be using head 3 after sorting to find out the top 3 values regardless of the combination.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Just change to:
stats max(c1693801001) as MaxCPU by measObjLdn | sort 3 - MaxCPU
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
++ simpler solution.
When i read the docs, it says "Specify the number of results to sort. " so I assumed only the first 3 events would be used but it should says "Specify the number of sorted results to return" instead.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
tks all, the one below by ramdaspr works also.
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
