Splunk Search
Highlighted

Top 10 values from 10 different columns?

Path Finder

I want top 10 values from the below query:
Problem is , we have applied stats average on multiple column, so simply writing top 10 or head 10 won't work in this case. Sorting is also an issue in this case.

...
|stats avg(httpdata) as "HTTP",avg(httpsdata) as "HTTPS",avg(rtspdata) as "RTSP",avg(rtpdata) as "RTP",avg(wtpdata) as "WTP",avg(wspdata) as "WSP",avg(mmsdata) as "MMS",avg(sipdata) as "SIP",avg(ftpdata) as "FTP",avg(dnsdata) as "DNS Lookups",avg(smtpdata) as "SMTP",avg(pop3data) as "POP3",avg(imapdata) as "IMAP",avg(skypedata) as "SKYPE",avg(torrentdata) as "TORRENT",avg(msndata) as "MSN",avg(yahoodata) as "YAHOO",avg(ddlinkdata) as "DDLINK" ,avg(jabberdata) as "JABBER",avg(ppstreamdata) as "PPSTREAM",avg(steamdata) as "STEAM",avg(imeshdata) as "IMESH",avg(hamachivpndata) as "HAMACHIVPN",avg(mutedata) as "MUTE",avg(pandodata) as "PANDO",avg(orbdata) as "ORB",avg(winnydata) as "WINNY",avg(slingboxdata) as "SLINGEBOX",avg(fasttrack_data) as "FASTTRACK"

Tags (1)
0 Karma
Highlighted

Re: Top 10 values from 10 different columns?

SplunkTrust
SplunkTrust

If you basically have one row and loads of columns you can transpose the result and then work with one column.

View solution in original post

Highlighted

Re: Top 10 values from 10 different columns?

Path Finder

No, this will not work.Transpose will categorize all values in one column but still TOP or SORT command won't work here, as there will be no column name and data is different.

0 Karma
Highlighted

Re: Top 10 values from 10 different columns?

SplunkTrust
SplunkTrust

Sort and head work perfectly, consider this as an example:

| gentimes start=-1 increment=5m | stats avg(starttime) as avg1 avg(endtime) as avg2 max(starttime) as max1 max(endtime) as max2 min(starttime) as min1 min(endtime) as min2 | transpose | sort - "row 1" | head 3
0 Karma