Splunk Search

sort after limit row?

chengyu
Path Finder

Hi:

I'hope sort after limit row, i try head or sort limit or top...but fail, what can i do?
Thank you

sourcetype=xxx |eval bandwidth=rcvdbyte+sentbyte | eval bandwidth(MB) = round(bandwidth/1024/1024,2) | stats list(dstip) as dstip values(app) as app values(hostname) as hostname sum(bandwidth(MB)) as bandwidth(MB) by srcip|  table srcip,dstip,app,hostname bandwidth(MB)|sort bandwidth(MB) desc 

now:

srcip dstip ... bandwidth(MB)
1.1.1.1 2.2.2.2 5
3.3.3.3 5
4.4.4.4 5
....
10.10.10.10

hope modify to dstip limit 3:

srcip dstip ... bandwidth(MB)
1.1.1.1 2.2.2.2 5
3.3.3.3 5
4.4.4.4 5

Tags (3)
0 Karma
1 Solution

lguinn2
Legend

I am not sure exactly what you want here, but you have some errors in your search. First ( is not a valid character in a field name, unless you enclose it in quotation marks (sometimes double quotes and sometimes single quotes). So I suggest that you use a different field name like bandwidthMB to avoid this problem.

sourcetype=xxx 
|eval bandwidth=rcvdbyte+sentbyte 
| eval bandwidthMB = round(bandwidth/1024/1024,2) 
| stats list(dstip) as dstip values(app) as app values(hostname) as hostname sum(bandwidthMB) as bandwidthMB by srcip
| sort  10 -bandwidthMB

By adding the 10 into the sort command, you will only see the top 10 values of bandwidthMB

If you only want to see the top 3 values of dstip, you can do this:

sourcetype=xxx 
| eval bandwidthMB=round((rcvdbyte+sentbyte )/1024/1024,2) 
| stats count sum(bandwidthMB) as bandwidthMB by dstip app hostname srcip
| sort srcip -count
| stats list(dstip) as dstip values(app) as app values(hostname) as hostname sum(bandwidthMB) as bandwidthMB by srcip
| eval dstipList = mvjoin(dstip,";")
| eval dstipList = replace(dstipList,"^(.+?;.+?;.+?);.*","\1")
| eval dstip=split(dstipList,";")
| fields - dstipList
| sort 10 -bandwidthMB

View solution in original post

0 Karma

lguinn2
Legend

I am not sure exactly what you want here, but you have some errors in your search. First ( is not a valid character in a field name, unless you enclose it in quotation marks (sometimes double quotes and sometimes single quotes). So I suggest that you use a different field name like bandwidthMB to avoid this problem.

sourcetype=xxx 
|eval bandwidth=rcvdbyte+sentbyte 
| eval bandwidthMB = round(bandwidth/1024/1024,2) 
| stats list(dstip) as dstip values(app) as app values(hostname) as hostname sum(bandwidthMB) as bandwidthMB by srcip
| sort  10 -bandwidthMB

By adding the 10 into the sort command, you will only see the top 10 values of bandwidthMB

If you only want to see the top 3 values of dstip, you can do this:

sourcetype=xxx 
| eval bandwidthMB=round((rcvdbyte+sentbyte )/1024/1024,2) 
| stats count sum(bandwidthMB) as bandwidthMB by dstip app hostname srcip
| sort srcip -count
| stats list(dstip) as dstip values(app) as app values(hostname) as hostname sum(bandwidthMB) as bandwidthMB by srcip
| eval dstipList = mvjoin(dstip,";")
| eval dstipList = replace(dstipList,"^(.+?;.+?;.+?);.*","\1")
| eval dstip=split(dstipList,";")
| fields - dstipList
| sort 10 -bandwidthMB
0 Karma

chengyu
Path Finder

Thank you so much.

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...