Splunk Search

How to Get required top users where I am sorting timechart by user

tkadale
Path Finder

I am showing a timechart by users. I want to show top 10 users on the graph having some particular condition. How to achieve that??

Tags (1)
0 Karma

howyagoin
Contributor

Just to chime in with the others, I do something akin to what you do with the following:

<various search commands> | stats count by Username | sort limit=10 -count

I have a field which is recognised as Username and have found this gets me the result I want best. Not quite a timechart, but, easy enough to modify to get that.

0 Karma

sideview
SplunkTrust
SplunkTrust

Well what's your particular condition?

The idea is to use the search language before the timechart clause, to filter the set of users down to whatever it is you want, and then pipe those filtered results to timechart count by user. You might use searchterms using the =, < or > operators, you might have a parenthetic clause like (foo OR bar OR baz), or some NOT terms like NOT status=304, you can pipe to the eval or rex commands to do fancier things, then you filter again with another search clause or a where clause, etc. The sky's the limit.

0 Karma

Christian
Path Finder

Hi,

i think head will resolve your question : http://www.splunk.com/base/Documentation/latest/SearchReference/Head

mysearchquery | head 10

christian

0 Karma

Christian
Path Finder

just to make this all complete watch also for the top command (http://www.splunk.com/base/Documentation/latest/SearchReference/top)

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...