Splunk Search

How to get first 10 search results on timechart

Path Finder

I want to show a graph for min free disk space for the hosts. But I want to show only first 10 hosts on graph having free disk space as lowest.
My basic query is:
index="tougou" sourcetype="disk" | fields free_disk_MB, host | timechart min(free_disk_MB) by host limit=10 useother=f

How to improve this query to get only first 10 hosts having lowest free disk space?

Tags (1)
0 Karma

Path Finder

Hi,

i would say this will solve you problem :
http://www.splunk.com/base/Documentation/latest/SearchReference/Head

or in your example :
index="tougou" sourcetype="disk" | fields free_disk_MB, host | timechart min(free_disk_MB) by host limit=10 useother=f | head 10

0 Karma

Path Finder

well it depends on your query, head will return you the first 10 rows of your search so you either sort it before or using the top command http://www.splunk.com/base/Documentation/latest/SearchReference/top , which is probably the easier way 🙂 sorry didn't think on that before

0 Karma

Path Finder

Will it give me the top users having lowest free disk space, or it will give me first 10 results. I want those 10 users having lowest free disk space.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!