Splunk Search

How to limit the number of bars in a bar graph

brajaram
Communicator

I have a query that produces a bar graph of the number of hits in a page. I want to limit this to the top 5-10 values, but I can't seem to get either the limit or top function to do what I need. What am I missing here?

index= sourcetype=source= pageURL=< dynamic field input >| stats count as PageHit by uniqueID | stats count as UserCount by PageHit | sort PageHit

Adding limit or top cannot seem to get the same graph as the full query produces, and just removes the small values.

Tags (4)
0 Karma
1 Solution

elliotproebstel
Champion

Doing | sort PageHit will, by default, sort from lowest values to highest values. If you want the top five, try this:

index= sourcetype=source= pageURL=< dynamic field input >
| stats count as PageHit by uniqueID 
| stats count as UserCount by PageHit 
| sort -PageHit
| head 5

By using | sort -PageHit instead, you will reverse the sorting order, and then |head 5 will limit to the first five items.

View solution in original post

elliotproebstel
Champion

Doing | sort PageHit will, by default, sort from lowest values to highest values. If you want the top five, try this:

index= sourcetype=source= pageURL=< dynamic field input >
| stats count as PageHit by uniqueID 
| stats count as UserCount by PageHit 
| sort -PageHit
| head 5

By using | sort -PageHit instead, you will reverse the sorting order, and then |head 5 will limit to the first five items.

brajaram
Communicator

Thanks! I didn't even know head was a solution, worked fine for me.

0 Karma

DalJeanis
Legend

@elliotproebstel - That will work fine, but this is more succinct...

| sort 5 - PageHit

elliotproebstel
Champion

Ohh, didn't realize that was an option! Thanks!

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...