Splunk Search

Top 3 results within a group from table

pradeepkumarg
Influencer

How can i get the top 3 rows from each group in a table.

Here is sample data output from my query

The output is result of


..| stats sum(fieldB) by fieldA, fieldC,fieldD,fieldE | table fieldA, sum(fieldB),fieldC,fieldD,fieldE | sort fieldA, -sum(fieldB)


fieldA sum(fieldB) fieldC fieldD fieldE

111 1500 abc def ghi
111 1000 yui mmm ybv
111 800 abc def yui
111 700 qwe sdf ghi
111 500 sdf def iuo
222 3500 yui hgu lop
222 2800 abc mmm ghi
222 1400 hji sdf lok
222 900 yui def mmm
333 3000 abc def nnn
333 1200 mmm edr yui
333 300 abc def ghi
333 100 mmm yui ghi

Now, how can I get top 3 rows from each of fieldA group ? Output should be as below

fieldA     sum(fieldB)      fieldC      fieldD      fieldE

  111          1500         abc             def         ghi
  111          1000         yui             mmm         ybv
  111           800         abc             def         yui
  222          3500         yui             hgu         lop
  222          2800         abc             mmm         ghi
  222          1400         hji             sdf         lok
  333          3000         abc             def         nnn
  333          1200         mmm             edr         yui
  333           300         abc             def         ghi
Tags (4)
0 Karma
1 Solution

HiroshiSatoh
Champion

How about in this?

..| stats sum(fieldB) by fieldA, fieldC,fieldD,fieldE | table fieldA, sum(fieldB),fieldC,fieldD,fieldE | sort fieldA, -sum(fieldB)| dedup 3 fieldA

View solution in original post

HiroshiSatoh
Champion

How about in this?

..| stats sum(fieldB) by fieldA, fieldC,fieldD,fieldE | table fieldA, sum(fieldB),fieldC,fieldD,fieldE | sort fieldA, -sum(fieldB)| dedup 3 fieldA

pradeepkumarg
Influencer

That did the trick. Thanks much..

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...