Splunk Search

sitop storing all the top information

ruisantos
Path Finder

Is there a way to limit the amount of summary events stored by sitop. I have scheduled search running every night with a sitop limit=20 (to store only the 20 top results) but the limit option does seem to work is and I'm storing up to 60.000 events. is there a way to resolve that?

Tags (2)
0 Karma
1 Solution

Stephen_Sorkin
Splunk Employee
Splunk Employee

No, the summary index accelerators will store everything, since their contract is to provide accurate answers, even when combined with other time periods. If they truncated their results, then if some truncated value were dominant in another time period, its count would be incorrect.

If you know that your distribution is relatively consistent and you don't need percentage calculation, you could just use stats:

... | stats count by f | sort - count | head 20

If you do need the total count, it's a bit trickier, but still possible:

... | stats count by f | sort - count | streamstats count as serial | eval f = if(serial > 20, "OTHER", f) | stats count by f

View solution in original post

0 Karma

Stephen_Sorkin
Splunk Employee
Splunk Employee

No, the summary index accelerators will store everything, since their contract is to provide accurate answers, even when combined with other time periods. If they truncated their results, then if some truncated value were dominant in another time period, its count would be incorrect.

If you know that your distribution is relatively consistent and you don't need percentage calculation, you could just use stats:

... | stats count by f | sort - count | head 20

If you do need the total count, it's a bit trickier, but still possible:

... | stats count by f | sort - count | streamstats count as serial | eval f = if(serial > 20, "OTHER", f) | stats count by f
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...