Splunk Search

limiting column or cell results

dhammad
New Member

Hello All - I have the following search query with following search results below. What I like to do is to limit the Destinations to about 5 or 10. Currently with popular categories - I get double digit Destinations. Thanks for the help.

Query:

index=summary earliest="-1d@d" latest="-1d@d+1h" | fields category, total_bytes, cs_uri_authority | eval domain=lower(cs_uri_authority) | stats sum(eval(round(total_bytes/1024/1024,2))) as b by category, domain | sort -b | stats sum(b) as CategoryMBytes, list(domain) as Destinations, list(b) as DestinationMBytes by category | eventstats sum(CategoryMBytes) as TotalMBytes | eval PercentOfTotal = 100 * CategoryMBytes / TotalMBytes . "%" | sort -CategoryMBytes | rename category as Category | table Category, CategoryMBytes, PercentOfTotal, Destinations, DestinationMBytes | head 10

Result:

Category            CategoryMBytes     PercentOfTotal    Destinations       DestinationMBytes
-----------------------------------------------------------------------------------------------
Audio/Video Clips    500               26.005%           ytimg.com          300
                                                         youtube.com        82.09
                                                         go.com             10
                                                         123.com            10
                                                         blahblah.com       10
                                                         wjla.com           10
                                                           ....
    

News/Media           473               22.5%             nytimes.com        34.18
                                                         washingtonpost.com 10
0 Karma

somesoni2
SplunkTrust
SplunkTrust

You can use following after your search query.

index=summary earliest="-1d@d" latest="-1d@d+1h" | fields category, total_bytes, cs_uri_authority | eval domain=lower(cs_uri_authority) | stats sum(eval(round(total_bytes/1024/1024,2))) as b by category, domain | sort -b | stats sum(b) as CategoryMBytes, list(domain) as Destinations, list(b) as DestinationMBytes by category | eventstats sum(CategoryMBytes) as TotalMBytes | eval PercentOfTotal = 100 * CategoryMBytes / TotalMBytes . "%" | sort -CategoryMBytes | rename category as Category | table Category, CategoryMBytes, PercentOfTotal, Destinations, DestinationMBytes | head 10

| eval Destinations=mvindex(Destinations,0,10)| eval DestinationMBytes =mvindex(DestinationMBytes ,0,10)

Just to tell you, it will not affect values in other columns, it will just truncate the values shown on the Destinations and DestinationMBytes. Hope this helps.

0 Karma

dhammad
New Member

Thank you very much - That does the trick.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...