Splunk Search

How to filter top 3 counts over each group?

Explorer

Here is data I get after count by Message and Error Code.

Message ErrorCode Count
Msg1 1000 500
Msg1 1001 400
Msg1 1002 300
Msg1 1003 200
Msg1 1004 100
Msg2 2000 550
Msg2 2001 450
Msg2 2002 350
Msg2 2003 250
Msg2 2004 150

I want top 3 count of each Msg. How can I get result as below?
Message ErrorCode Count
Msg1 1000 500
Msg1 1001 400
Msg1 1002 300
Msg2 2000 550
Msg2 2001 450
Msg2 2002 350

Tags (3)
0 Karma
1 Solution

Influencer

... | sort Message -count | dedup 3 Message

View solution in original post

Influencer

... | sort Message -count | dedup 3 Message

View solution in original post

Explorer

Thanks, gpradeepkumarreddy.
This method is more simple. But It is sort by count after dedup.
I need to sort again at the end.

0 Karma

Explorer

Sorry, my mistake, no need to sorting is not changed after dedup

0 Karma

SplunkTrust
SplunkTrust

Try something like this

Your current search giving Count by Message and ErrorCode | sort 0 Message -Count | streamstats count as rank by Message | where rank<=3 | fields - rank 

Explorer

Thanks, somesoni2.
This is really what I want. 🙂

0 Karma

Champion

Does this do the trick?

... | top limit=3 showperc=f ErrorCode by Message

Do it instead of stats count by Message ErrorCode.

Explorer

Thanks, jeffland. It works! 🙂

Do you have any idea if I want to search with data model? (|tstats command)
Seem I can only use raw search now.

0 Karma

Champion

Sorry, I don't know why you wouldn't be able to use this with a data model. I must admit though that I don't work with data models a lot.

0 Karma