Splunk Search

Top 10 Values of the column

SanthoshSreshta
Contributor

Hi all,

I am able to get top 10 values but with that I need to get others ( Those who are not in Top 10 ) in one value called other. So totally need 11 values. 10 are top 10 and other in one chart. any help please...

I have used sourcetype="Churn Data_CSV" Churn="True." | top limit=10 state for displaying top 10 values.

Regards,
Santhosh.

1 Solution

jtrucks
Splunk Employee
Splunk Employee

Try this:

sourcetype="Churn Data_CSV" Churn="True." | top limit=10 state useother=t

Read the docs at http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Top#Optional_arguments. It says the following for useother:

useother
Syntax: useother=<bool>
Description: Specify whether or not to add a row that represents all values not included due to the limit cutoff. Default is false.

--
Jesse Trucks
Minister of Magic

View solution in original post

jtrucks
Splunk Employee
Splunk Employee

Try this:

sourcetype="Churn Data_CSV" Churn="True." | top limit=10 state useother=t

Read the docs at http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Top#Optional_arguments. It says the following for useother:

useother
Syntax: useother=<bool>
Description: Specify whether or not to add a row that represents all values not included due to the limit cutoff. Default is false.

--
Jesse Trucks
Minister of Magic

SanthoshSreshta
Contributor

How to use that useother in this example sourcetype="Churn Data_CSV" Churn="True." | stats count(Churn) as "Churn Count" by state |sort - "Churn Count" |head 10

0 Karma

jtrucks
Splunk Employee
Splunk Employee

The top command by default will count the number of events with the field (or unique combinations when given multiple fields) and output the count into a new field called count with another new field called percentage. The search you have will only contain events that have the Churn field equal to True., which means that a count of every event broken down by state will provide the results you seem to want.

You can suppress the display of the percentage field; rename the count field; display a sorted list of largest to smallest of the highest counts for each state; and include the OTHER field (which can, also, be renamed) like this:

sourcetype="Churn Data_CSV" Churn="True." | top limit=10 countfield="Churn Count" showperc=f state useother=t

Does this produce your desired results?

--
Jesse Trucks
Minister of Magic
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...