How to exclude last 3 values in the search results.

[vkumar6]

Hi ,

I need exclude the values last 3 three values from the search results. Can someone please help me on this.

index=main source=blr*| stats count by ENGINE

ENGINE count
9.850.1008 2
9.860.1008 2
9.870.1008 3
9.880.1008 4
9.900.1008 5

When i runs query it should exclude the last 3 values and should give the count.

Thanks,
Vijay

[adonio · Accepted solution]

Hello Vijay,
you can use the sort command.
example: index="_internal" | stats count by sourcetype | sort 3 -count
try on your search.
more on the command here:
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/sort

hope it helps