Remove top from results

[rhum_defintel]

I want to remove the top results from my final results. Essentially, removing outliers.

[altink]

Hello

is there any development on this ?

remove top x rows from result

best regards
Altin

[devin_stonecyph]

Look into the outlier command. http://docs.splunk.com/Documentation/Splunk/6.1.3/SearchReference/Outlier

[landen99]

search | sort -field1 | head 20

[yannK]

if you want to filter the highest values, you can use a where condition, or an eval to normalize it.

example :

sourcetype=mysourcetype | where myfield < 100 | timechart max(myfield) by host

sourcetype=mysourcetype | eval myfield=if(myfield<100,myfield,0) | timechart max(myfield) by host

[landen99]

grabs bottom 20 results

[rhum_defintel]

I want to remove the results that are listed in top.

[Ayn]

For getting the most common values there's top (http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Top ).

For getting the most rare values, rare (http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rare ).

There's also a number of statistical functions available that might be suitable for you to use: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonStatsFunctions

[rhum_defintel]

I have a timechart that has spikes of data. I would like to remove those spikes so I can calculate an average.

[Ayn]

Give more details on what you want to achieve, preferrably with some sample events so we know more about how to solve the problem.