Can the limit command be used with multiple conditions?
My search query is as follows | stats count as num by searchTerm, domain. I want to return the top 3 searchterms per domain. Is there a way to do that from the search bar in splunk UI?
Domain searchTerm Number
Google ABC 100
Google DEF 50
Google GHI 25
Yahoo DEF 75
Yahoo ABC 60
Yahoo JKL 20
Bing DEF 80
Bing JKL 40
Bing GHI 20
try something like this:
your base search here | stats count as num by searchTerm, domain | sort domain, -num | streamstats num as rank by domain | where rank < 4
Hope this helps to get you started ...
Thanks! That worked. I hadn't worked much with streamstats before, but it looks very powerful. I will check it out. Offhand, do you know if streamstats works with report acceleration?
According to the docs http://docs.splunk.com/Documentation/Splunk/6.2.1/Report/Acceleratereports#How_reports_qualify_for_r... only
transforming commands qualify for report acceleration. Find a list of transforming commands here http://docs.splunk.com/Splexicon:Transformingcommand
Feel free to accept this answer if it answered your question - you get some kudos as well 😉