Splunk Search

How to limit the number of bars in a bar graph

brajaram
Communicator

I have a query that produces a bar graph of the number of hits in a page. I want to limit this to the top 5-10 values, but I can't seem to get either the limit or top function to do what I need. What am I missing here?

index= sourcetype=source= pageURL=< dynamic field input >| stats count as PageHit by uniqueID | stats count as UserCount by PageHit | sort PageHit

Adding limit or top cannot seem to get the same graph as the full query produces, and just removes the small values.

Tags (4)
0 Karma
1 Solution

elliotproebstel
Champion

Doing | sort PageHit will, by default, sort from lowest values to highest values. If you want the top five, try this:

index= sourcetype=source= pageURL=< dynamic field input >
| stats count as PageHit by uniqueID 
| stats count as UserCount by PageHit 
| sort -PageHit
| head 5

By using | sort -PageHit instead, you will reverse the sorting order, and then |head 5 will limit to the first five items.

View solution in original post

elliotproebstel
Champion

Doing | sort PageHit will, by default, sort from lowest values to highest values. If you want the top five, try this:

index= sourcetype=source= pageURL=< dynamic field input >
| stats count as PageHit by uniqueID 
| stats count as UserCount by PageHit 
| sort -PageHit
| head 5

By using | sort -PageHit instead, you will reverse the sorting order, and then |head 5 will limit to the first five items.

brajaram
Communicator

Thanks! I didn't even know head was a solution, worked fine for me.

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

@elliotproebstel - That will work fine, but this is more succinct...

| sort 5 - PageHit

elliotproebstel
Champion

Ohh, didn't realize that was an option! Thanks!

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...