Splunk Search

Limit Search Results in Chart to Top 10

dmmaloy
New Member

I have a search that returns results for the previous three months for multiple entities. Due to the large number of entities I want to limit the search to the top 10.
This is the search:
sourcetype=escada_message Message=FAILED AOR_Group=Gas NOT ACKNOWLEDGD NOT DELETED | rex field=Message "(?[A-Za-z]+\s[A-Za-z]+)" | eval Month=strftime(_time,"%m/%Y") | chart count over Message by Month

Tags (2)
0 Karma

nickhills
Ultra Champion
sourcetype=escada_message Message=FAILED AOR_Group=Gas NOT ACKNOWLEDGD NOT DELETED 
| rex field=Message "(?[A-Za-z]+\s[A-Za-z]+)" 
| eval Month=strftime(_time,"%m/%Y") 
| chart count over Message by Month limit=10 useother=false

This will give the top 10 months - possibly not what you are after, so switch the chart round for the top 10 messages

sourcetype=escada_message Message=FAILED AOR_Group=Gas NOT ACKNOWLEDGD NOT DELETED 
| rex field=Message "(?[A-Za-z]+\s[A-Za-z]+)" 
| eval Month=strftime(_time,"%m/%Y") 
| chart count over Month by Message limit=10 useother=false

useother=false prevents the output from rolling up other values into 'other'

If my comment helps, please give it a thumbs up!

dmmaloy
New Member

Using Message by Month doesn't reduce the number of results. Month by Message reduces the results but the results are organized by month.
I need it to display each station's monthly totals together to be viewed in a trend pattern by station.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...