Splunk Search

How to sort the results of a timechart top 5 clients list by client percentage?

tmurray3
Path Finder

I have the following query to generate a list of the top 5 clients by volume percentage:

index=volume_hourly_summary report="keyvolumebyhour" | timechart span=1w sum(count) by clientkey limit=5| untable _time clientkey count|eventstats sum(count) as Total by _time|eval clientpercent=round(count*100/Total,2)| table _time,clientkey clientpercent| xyseries _time clientkey clientpercent

I have tried to get the results to be sorted by client percentage, but the output is always sorted by clientkey.

Any ideas?

Thanks in advance for your help!!

Tags (2)
0 Karma

dounla2carlos
Explorer

there is problem in your request
sum(count) the field count doesnt exist so you wont get any interesting result
If the output is always sorted by clientkey, its because of this: "timechart span=1w sum(count) by clientkey limit=5"
To have them sorted by Clientpercent you need have a count by Clientpercent n your request

0 Karma

gyslainlatsa
Motivator

Hi tmurray3 ,
try use the sort command as below

index=volume_hourly_summary report="keyvolumebyhour" | timechart span=1w sum(count) by clientkey limit=5| untable _time clientkey count|eventstats sum(count) as Total by _time|eval clientpercent=round(count*100/Total,2)| table _time,clientkey clientpercent| xyseries _time clientkey clientpercent |sort -Clientpercent

sort -Clientpercent to sort in descending order

0 Karma

somesoni2
SplunkTrust
SplunkTrust

With current query you're getting top 5 clientkey for every week and the clientkey may be different in every week. How many columns you get in the final result?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...