I need to create a new field to assign to the top results of a command using eval.
Obviously this syntax doesn't work, so I'm looking for the correct query:
source="tutorialdata.zip*" | eval popular = top limit=5 itemId | stats count(action) by popular, action
Basically I only need the action stats of the top 5 itemId results of the following:
Sorry for the n00b question; I am just getting started with Splunk. Thanks for your time!
Is this what you're after?
source="tutorialdata.zip*"
| eval X_{action}=action
| stats count as total count(X_*) as X_* by itemId
| sort - total
| head 5
| rename X_* as *
| fields - total
That will give you 5 rows of the most frequent itemId and then each column is a count of actions
Note the X_ prefix to the new field created is to allow the use of wildcards in the stats command to only collect the fields you're interested in.
You could also replace the eval/stats with
| eval X_{action}=1
| stats count as total sum(X_*) as X_* by itemId
which may be slightly more efficient
Is this what you're after?
source="tutorialdata.zip*"
| eval X_{action}=action
| stats count as total count(X_*) as X_* by itemId
| sort - total
| head 5
| rename X_* as *
| fields - total
That will give you 5 rows of the most frequent itemId and then each column is a count of actions
Note the X_ prefix to the new field created is to allow the use of wildcards in the stats command to only collect the fields you're interested in.
You could also replace the eval/stats with
| eval X_{action}=1
| stats count as total sum(X_*) as X_* by itemId
which may be slightly more efficient
This works; thank you kindly!