Splunk Search
Highlighted

How to use top in timechart

Explorer

Hi All,

I have a requirement to use TOP 4 in the timechart command:

Below is my search:

index=_internal |timechart count by sourcetype limit=5 span=1d|addcoltotals

(7DAYS DATA)
I need the top 4 column values of (sourcetype) as shown in the screenshot like SPLUNKD,SPLUNKUIACCESS,SPLUNKWEBACCESS,SPLUNKWEBSERVICE only
alt text
Thanks
PR

0 Karma
Highlighted

Re: How to use top in timechart

Legend

Couldn't the top 4 sourcetypes be different for each day?

0 Karma
Highlighted

Re: How to use top in timechart

SplunkTrust
SplunkTrust

Try like this

index=_internal | bucket span=1d _time | stats count by _time sourcetype | eventstats sum(count) as total by sourcetype | sort - total | streamstats current=f window=1 values(total) as prev | eval sno=case(isnull(prev),1,prev=total,0,1=1,1) | accum sno | where sno<5 | table _time sourcetype count | xyseries _time sourcetype count | addcoltotals

View solution in original post

Highlighted

Re: How to use top in timechart

Explorer

Thanks Somesh

0 Karma