Splunk Search

statsコマンドで計算した結果の上位何件だけを表示させる方法について

70250939
Explorer

indexに"count"というフィールドがあり、"user"ごとに"count"を合計を出し、数が多い順に表示させています。

|stats sum(count) by user
|sort - sum(count)

数が少ないひとは除外したいため、数が多い上位10名だけ表示させたいとした場合、どのようなコマンドを使えばよろしいでしょうか?
topコマンドなど使用してみたりしたのですが結果が変わってしまったり、うまく表示されなかったりしています。

いい方法ご存知の方アドバイスよろしくお願いいたします。

Tags (2)
0 Karma

vasanthmss
Motivator

English Version of question:

index to have a field called "count", for each "user" and issued a total of "count", you have to appear in the order number is large.

| stats sum (count) by user
| sort - sum (count)

For human small number you want to exclude, if you want to display only a large number top ten, Are you sure you want if you use any kind of command?
top and I was or try to use such as a command or have changed but a result, we have may not be displayed well.

Better advice thank you for a good way you know.

V
0 Karma

vasanthmss
Motivator

try this,

|stats sum(count) as total by user | sort - total | head 10

Cheers!

V

70250939
Explorer

出来ました!ありがとうございました。

0 Karma

vasanthmss
Motivator

hope this helps you.

V
0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...