Splunk Search

How to get first 10 search results on timechart

tkadale
Path Finder

I want to show a graph for min free disk space for the hosts. But I want to show only first 10 hosts on graph having free disk space as lowest.
My basic query is:
index="tougou" sourcetype="disk" | fields free_disk_MB, host | timechart min(free_disk_MB) by host limit=10 useother=f

How to improve this query to get only first 10 hosts having lowest free disk space?

Tags (1)
0 Karma

Christian
Path Finder

Hi,

i would say this will solve you problem :
http://www.splunk.com/base/Documentation/latest/SearchReference/Head

or in your example :
index="tougou" sourcetype="disk" | fields free_disk_MB, host | timechart min(free_disk_MB) by host limit=10 useother=f | head 10

0 Karma

Christian
Path Finder

well it depends on your query, head will return you the first 10 rows of your search so you either sort it before or using the top command http://www.splunk.com/base/Documentation/latest/SearchReference/top , which is probably the easier way 🙂 sorry didn't think on that before

0 Karma

tkadale
Path Finder

Will it give me the top users having lowest free disk space, or it will give me first 10 results. I want those 10 users having lowest free disk space.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...