Splunk Search

top N results of values(X)

atanasmitev
Path Finder

Hello,
I have a column list received from "values(mymail)"

abra@sth.com
cada@sth.com
bra@sth.com
this@sth.com
is@sth.com
anew@sth.com

I need to get top/head N results of that list with the idea that values(mymail) can reach thousands of rows.

The whole search string related to the question is :

$SEARCH | stats count dc(mymail) as unique count(mymail) as hits values(mymail) as list by VAR

How do I do that ? 🙂

I tried with eval
just before |stats like eval email_list=(values(mymail)|head 10 ), but it seems not right

Tags (3)
0 Karma

Runals
Motivator

You could maybe use the following to break out the individual items in the list field but am having trouble imagining what the rest of your stats command output is - haven't had enough caffeine yet I suppose.

| makemv list | mvexpand list

At any rate you would then need another stats (+ sort & head) or top command to then get your top X.

0 Karma

somesoni2
Revered Legend

Try something like this

$SEARCH | stats count dc(mymail) as unique count(mymail) as hits values(mymail) as list by VAR 
| eval sno=mvrange(0,10,1) | eval list=mvzip(list,sno,",") |nomv list| eval list=replace(list,"(,\d+)"," ") | makemv list

The no '10' in the mvrange command denotes you will be returned first 10 values from the multivalued field 'list'

0 Karma
Get Updates on the Splunk Community!

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...