Splunk Search
Highlighted

How to limit results with multiple group by conditions?

Explorer

Can the limit command be used with multiple conditions?

My search query is as follows | stats count as num by searchTerm, domain. I want to return the top 3 searchterms per domain. Is there a way to do that from the search bar in splunk UI?

Desired Output:

Domain searchTerm Number
Google ABC 100
Google DEF 50
Google GHI 25
Yahoo DEF 75
Yahoo ABC 60
Yahoo JKL 20
Bing DEF 80
Bing JKL 40
Bing GHI 20

Tags (3)
0 Karma
Highlighted

Re: How to limit results with multiple group by conditions?

SplunkTrust
SplunkTrust

Hi alchang,

try something like this:

your base search here 
| stats count as num by searchTerm, domain
| sort domain, -num 
| streamstats num as rank by domain
| where rank < 4

Hope this helps to get you started ...

cheers, MuS

Highlighted

Re: How to limit results with multiple group by conditions?

Explorer

Thanks! That worked. I hadn't worked much with streamstats before, but it looks very powerful. I will check it out. Offhand, do you know if streamstats works with report acceleration?

0 Karma
Highlighted

Re: How to limit results with multiple group by conditions?

SplunkTrust
SplunkTrust

According to the docs http://docs.splunk.com/Documentation/Splunk/6.2.1/Report/Acceleratereports#How_reports_qualify_for_r... only transforming commands qualify for report acceleration. Find a list of transforming commands here http://docs.splunk.com/Splexicon:Transformingcommand

Feel free to accept this answer if it answered your question - you get some kudos as well 😉

0 Karma