Splunk Search

sitop storing all the top information

ruisantos
Path Finder

Is there a way to limit the amount of summary events stored by sitop. I have scheduled search running every night with a sitop limit=20 (to store only the 20 top results) but the limit option does seem to work is and I'm storing up to 60.000 events. is there a way to resolve that?

Tags (2)
0 Karma
1 Solution

Stephen_Sorkin
Splunk Employee
Splunk Employee

No, the summary index accelerators will store everything, since their contract is to provide accurate answers, even when combined with other time periods. If they truncated their results, then if some truncated value were dominant in another time period, its count would be incorrect.

If you know that your distribution is relatively consistent and you don't need percentage calculation, you could just use stats:

... | stats count by f | sort - count | head 20

If you do need the total count, it's a bit trickier, but still possible:

... | stats count by f | sort - count | streamstats count as serial | eval f = if(serial > 20, "OTHER", f) | stats count by f

View solution in original post

0 Karma

Stephen_Sorkin
Splunk Employee
Splunk Employee

No, the summary index accelerators will store everything, since their contract is to provide accurate answers, even when combined with other time periods. If they truncated their results, then if some truncated value were dominant in another time period, its count would be incorrect.

If you know that your distribution is relatively consistent and you don't need percentage calculation, you could just use stats:

... | stats count by f | sort - count | head 20

If you do need the total count, it's a bit trickier, but still possible:

... | stats count by f | sort - count | streamstats count as serial | eval f = if(serial > 20, "OTHER", f) | stats count by f
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...