Splunk Search

How to create a field value from a group of values in the same field?

diabinho
Explorer

I m trying to create a table were I want to display the 3 biggest values (count) from a field and the existing remain as "others". For example:

Field1 count
A 27
B 20
C 8
others 239

How do I achieve to create "others" ?

*Others=D, E,F, ... (total count of occurrences)

Thanks

0 Karma

diabinho
Explorer

I think I got it by applying |timechart span=5m limit=9 usenull=f useother=true count by ALPHABET
|fields + "A" "F" "G" "OTHER"

0 Karma

richgalloway
SplunkTrust
SplunkTrust

@diabinho If your problem is resolved, please accept an answer to help future readers.

---
If this reply helps you, Karma would be appreciated.
0 Karma

mayurr98
Super Champion

try this:

.. |top limit=3 Field1 useother=1 showperc=f

diabinho
Explorer

Thank you for the help but I posted my question wrongly, never the less your answer helped me with something else 🙂

What I really want is something like this:
alt text

Being A, F and G always there despite the number of counts, and OTHER are just the remaining ones. I know if I use limit=limit_number I get automatically OTHER but I cant see how to "stick" A, F and G there.

Any thoughts?

Thanks

0 Karma

diabinho
Explorer

Hello mayurr98,

It helped but it isn't what I was looking for but that's my bad, I didn't explain properly, never the less it helped me with something else.

Thanks

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...