Splunk Search

top command with values

jangid
Builder

I want top 10 values for a field based on the timer control.

mysearch | top 10 E_Time

above command return top 10 results based on the events count. is there anyway to return top 10 values and display a graph based on these values?

alternatively I can run this search and display the graph

mysearch | table _time E_TIME | sort -E_TIME | head 10 | where len(E_TIME) > 0

Tags (1)
1 Solution

Ayn
Legend

Use head:

... | head 10

EDIT: head will not necessarily return the latest results. The head command will retrieve the first X items from what it's given in the search pipeline. If it's run directly after the initial search command, then you are right, what comes in the search pipeline will be the latest events. If you run it after table though, for instance, it will get the table items and give you the first X of those. So, if you have a table with data that is sorted in the way you want, running head 10 will give you the first 10 items according to that sort order. I believe that's what you wanted.

View solution in original post

Ayn
Legend

Use head:

... | head 10

EDIT: head will not necessarily return the latest results. The head command will retrieve the first X items from what it's given in the search pipeline. If it's run directly after the initial search command, then you are right, what comes in the search pipeline will be the latest events. If you run it after table though, for instance, it will get the table items and give you the first X of those. So, if you have a table with data that is sorted in the way you want, running head 10 will give you the first 10 items according to that sort order. I believe that's what you wanted.

Ayn
Legend

Nope, top works with item counts exclusively, so you cannot use it to work with values.

0 Karma

jangid
Builder

Thanks Ayn, yep you are right I used | head x to get the result. I solved my problem with table | sort | head
buy my question, is it possible to get top 10 E_Time values [not events] using top command?

0 Karma

Ayn
Legend

No. Updated my answer, please read.

0 Karma

jangid
Builder

this will return latest result. I want top 10 values from a particular field.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...