Splunk Search
Highlighted

top piped to top yields no results for table

Contributor

v4.3.1 linux
so why piping top | top dont work?

index=ciscofirewall | top errorcode limit=5 | top src limit=10

certainly the 1st top returns a bunch of events that contain src, so why doesnt the default table show data after the 2nd top?

Tags (2)
0 Karma
Highlighted

Re: top piped to top yields no results for table

Ultra Champion

Sorry no, that's not how it works

index=cisco_firewall 

will give you...say 1 million events back.

index=cisco_firewall | top error_code limit=5 

will give you five events back, each containing aggregate statistics on error_code, but no information on src. Thats why this will never work.

index=cisco_firewall | top error_code limit=5 | top src limit=10

If you try;

index=cisco_firewall | top error_code limit=5 | top error_code limit=3

you will get results back, but perhaps not those you were expecting, since there are five unique events in terms of the value you're doing the final top on. The actual top count does not come into the equation. My guess is that you'll get the first three in numerical/alphabetical order.

/Kristian

Highlighted

Re: top piped to top yields no results for table

Contributor

then i dont quite understand the results, because when i click over to the events view it shows all of the returned events from the search, so doesnt the additioanl pipe act upon those results?

actually, index=ciscofirewall | top errorcode limit=5 gives me all of the events that have count(error_code) in top 5 of all error code counts. it tables 5 lines, but the raw event list is huge.

0 Karma
Highlighted

Re: top piped to top yields no results for table

Ultra Champion

No, not when you pipe it further along. At least not in my experience. /k

0 Karma
Highlighted

Re: top piped to top yields no results for table

Legend

In addition to kristian's answer, if what you want is retrieving the top 5 error codes and then checking which 10 values of src contributed the most to these, you'll likely want to use a subsearch (http://docs.splunk.com/Documentation/Splunk/latest/User/HowSubsearchesWork )

index=cisco_firewall [search index=cisco_firewall | top error_code limit=5 | fields error_code] | top src limit=10
Highlighted

Re: top piped to top yields no results for table

Ultra Champion
0 Karma
Highlighted

Re: top piped to top yields no results for table

Legend

Oh...sorry k 😉

0 Karma