Splunk Search

How to limit the number of bars in a bar graph

Communicator

I have a query that produces a bar graph of the number of hits in a page. I want to limit this to the top 5-10 values, but I can't seem to get either the limit or top function to do what I need. What am I missing here?

index= sourcetype=source= pageURL=< dynamic field input >| stats count as PageHit by uniqueID | stats count as UserCount by PageHit | sort PageHit

Adding limit or top cannot seem to get the same graph as the full query produces, and just removes the small values.

Tags (4)
0 Karma
1 Solution

Doing | sort PageHit will, by default, sort from lowest values to highest values. If you want the top five, try this:

index= sourcetype=source= pageURL=< dynamic field input >
| stats count as PageHit by uniqueID 
| stats count as UserCount by PageHit 
| sort -PageHit
| head 5

By using | sort -PageHit instead, you will reverse the sorting order, and then |head 5 will limit to the first five items.

View solution in original post

Doing | sort PageHit will, by default, sort from lowest values to highest values. If you want the top five, try this:

index= sourcetype=source= pageURL=< dynamic field input >
| stats count as PageHit by uniqueID 
| stats count as UserCount by PageHit 
| sort -PageHit
| head 5

By using | sort -PageHit instead, you will reverse the sorting order, and then |head 5 will limit to the first five items.

View solution in original post

Communicator

Thanks! I didn't even know head was a solution, worked fine for me.

0 Karma

SplunkTrust
SplunkTrust

@elliotproebstel - That will work fine, but this is more succinct...

| sort 5 - PageHit

Ohh, didn't realize that was an option! Thanks!

0 Karma