Splunk Search

How to sort the results of a timechart top 5 clients list by client percentage?

tmurray3
Path Finder

I have the following query to generate a list of the top 5 clients by volume percentage:

index=volume_hourly_summary report="keyvolumebyhour" | timechart span=1w sum(count) by clientkey limit=5| untable _time clientkey count|eventstats sum(count) as Total by _time|eval clientpercent=round(count*100/Total,2)| table _time,clientkey clientpercent| xyseries _time clientkey clientpercent

I have tried to get the results to be sorted by client percentage, but the output is always sorted by clientkey.

Any ideas?

Thanks in advance for your help!!

Tags (2)
0 Karma

dounla2carlos
Explorer

there is problem in your request
sum(count) the field count doesnt exist so you wont get any interesting result
If the output is always sorted by clientkey, its because of this: "timechart span=1w sum(count) by clientkey limit=5"
To have them sorted by Clientpercent you need have a count by Clientpercent n your request

0 Karma

gyslainlatsa
Motivator

Hi tmurray3 ,
try use the sort command as below

index=volume_hourly_summary report="keyvolumebyhour" | timechart span=1w sum(count) by clientkey limit=5| untable _time clientkey count|eventstats sum(count) as Total by _time|eval clientpercent=round(count*100/Total,2)| table _time,clientkey clientpercent| xyseries _time clientkey clientpercent |sort -Clientpercent

sort -Clientpercent to sort in descending order

0 Karma

somesoni2
Revered Legend

With current query you're getting top 5 clientkey for every week and the clientkey may be different in every week. How many columns you get in the final result?

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...