Splunk Search

How to get first 10 search results on timechart

tkadale
Path Finder

I want to show a graph for min free disk space for the hosts. But I want to show only first 10 hosts on graph having free disk space as lowest.
My basic query is:
index="tougou" sourcetype="disk" | fields free_disk_MB, host | timechart min(free_disk_MB) by host limit=10 useother=f

How to improve this query to get only first 10 hosts having lowest free disk space?

Tags (1)
0 Karma

Christian
Path Finder

Hi,

i would say this will solve you problem :
http://www.splunk.com/base/Documentation/latest/SearchReference/Head

or in your example :
index="tougou" sourcetype="disk" | fields free_disk_MB, host | timechart min(free_disk_MB) by host limit=10 useother=f | head 10

0 Karma

Christian
Path Finder

well it depends on your query, head will return you the first 10 rows of your search so you either sort it before or using the top command http://www.splunk.com/base/Documentation/latest/SearchReference/top , which is probably the easier way :slightly_smiling_face: sorry didn't think on that before

0 Karma

tkadale
Path Finder

Will it give me the top users having lowest free disk space, or it will give me first 10 results. I want those 10 users having lowest free disk space.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...