Splunk Search

Search for top results

JelianeL
Explorer

| eval totalCount = cCounter + lCounter

| eventstats max(totalCount) as maxTotal

| table id, time, message, cCounter, lCounter, totalCount

| sort -totalCount

Hi 😃 my current search command is as above.

How do I actually display only top 5 totalCount? I trying adding "top 5 totalCount", but does not work.

Tags (1)
0 Karma
1 Solution

Ayn
Legend

First of all I don't think that's your whole search?

Also, I don't know what you mean by top 5 - do you want to get just the first 5 results? In that case just add a | head 5 at the end and you should be done.

View solution in original post

Ayn
Legend

First of all I don't think that's your whole search?

Also, I don't know what you mean by top 5 - do you want to get just the first 5 results? In that case just add a | head 5 at the end and you should be done.

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...