Hi ,
I need exclude the values last 3 three values from the search results. Can someone please help me on this.
index=main source=blr*| stats count by ENGINE
ENGINE count
9.850.1008 2
9.860.1008 2
9.870.1008 3
9.880.1008 4
9.900.1008 5
When i runs query it should exclude the last 3 values and should give the count.
Thanks,
Vijay
Hello Vijay,
you can use the sort command.
example: index="_internal" | stats count by sourcetype | sort 3 -count
try on your search.
more on the command here:
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/sort
hope it helps
Hello Vijay,
you can use the sort command.
example: index="_internal" | stats count by sourcetype | sort 3 -count
try on your search.
more on the command here:
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/sort
hope it helps