Splunk Search

Top 10 Values of the column

SanthoshSreshta
Contributor

Hi all,

I am able to get top 10 values but with that I need to get others ( Those who are not in Top 10 ) in one value called other. So totally need 11 values. 10 are top 10 and other in one chart. any help please...

I have used sourcetype="Churn Data_CSV" Churn="True." | top limit=10 state for displaying top 10 values.

Regards,
Santhosh.

1 Solution

jtrucks
Splunk Employee
Splunk Employee

Try this:

sourcetype="Churn Data_CSV" Churn="True." | top limit=10 state useother=t

Read the docs at http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Top#Optional_arguments. It says the following for useother:

useother
Syntax: useother=<bool>
Description: Specify whether or not to add a row that represents all values not included due to the limit cutoff. Default is false.

View solution in original post

jtrucks
Splunk Employee
Splunk Employee

Try this:

sourcetype="Churn Data_CSV" Churn="True." | top limit=10 state useother=t

Read the docs at http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Top#Optional_arguments. It says the following for useother:

useother
Syntax: useother=<bool>
Description: Specify whether or not to add a row that represents all values not included due to the limit cutoff. Default is false.

SanthoshSreshta
Contributor

How to use that useother in this example sourcetype="Churn Data_CSV" Churn="True." | stats count(Churn) as "Churn Count" by state |sort - "Churn Count" |head 10

0 Karma

jtrucks
Splunk Employee
Splunk Employee

The top command by default will count the number of events with the field (or unique combinations when given multiple fields) and output the count into a new field called count with another new field called percentage. The search you have will only contain events that have the Churn field equal to True., which means that a count of every event broken down by state will provide the results you seem to want.

You can suppress the display of the percentage field; rename the count field; display a sorted list of largest to smallest of the highest counts for each state; and include the OTHER field (which can, also, be renamed) like this:

sourcetype="Churn Data_CSV" Churn="True." | top limit=10 countfield="Churn Count" showperc=f state useother=t

Does this produce your desired results?

Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...