I have a query that produces a bar graph of the number of hits in a page. I want to limit this to the top 5-10 values, but I can't seem to get either the limit or top function to do what I need. What am I missing here?
index= sourcetype=source= pageURL=< dynamic field input >| stats count as PageHit by uniqueID | stats count as UserCount by PageHit | sort PageHit
Adding limit or top cannot seem to get the same graph as the full query produces, and just removes the small values.
Doing | sort PageHit
will, by default, sort from lowest values to highest values. If you want the top five, try this:
index= sourcetype=source= pageURL=< dynamic field input >
| stats count as PageHit by uniqueID
| stats count as UserCount by PageHit
| sort -PageHit
| head 5
By using | sort -PageHit
instead, you will reverse the sorting order, and then |head 5
will limit to the first five items.
Doing | sort PageHit
will, by default, sort from lowest values to highest values. If you want the top five, try this:
index= sourcetype=source= pageURL=< dynamic field input >
| stats count as PageHit by uniqueID
| stats count as UserCount by PageHit
| sort -PageHit
| head 5
By using | sort -PageHit
instead, you will reverse the sorting order, and then |head 5
will limit to the first five items.
Thanks! I didn't even know head was a solution, worked fine for me.
@elliotproebstel - That will work fine, but this is more succinct...
| sort 5 - PageHit
Ohh, didn't realize that was an option! Thanks!