Splunk Search

How to sort a column chart to view the top 10 values?

bogdan_nicolesc
Communicator

Hi,

I try to make a column chart using this search:

index=webtrafic 
| rename ProcessName AS RootObject.ProcessName timestamp AS RootObject.timestamp
| fields "_time" "sourcetype" "RootObject.ProcessName" "RootObject.timestamp"
| stats dedup_splitvals=t count(RootObject.timestamp) AS "Count of timestamp"  by RootObject.ProcessName
| sort limit=5 RootObject.ProcessName
| fields - _span
| rename RootObject.ProcessName AS ProcessName
| fillnull "Count of timestamp"
| fields ProcessName, "Count of timestamp"

And i get this:

alt text

My question is: How can i sort columns so i can see top 5/10 highest values?

Thank you,
Bogdan

0 Karma

bogdan_nicolesc
Communicator

Hi marycordova,

If i use this command, i get this error:

Error in 'chart' command: The specifier 'Count of timestamp' is invalid. It must be in form (). For example: max(size).
The search job has failed due to an error. You may be able view the job in the Job Inspector.

if, however, i use this command:

(index=* OR index=_*) (index=webtrafic)
| rename ProcessName AS RootObject.ProcessName timestamp AS RootObject.timestamp
| fields "_time" "sourcetype" "RootObject.ProcessName" "RootObject.timestamp"
| stats dedup_splitvals=t count(RootObject.timestamp) AS "Count of timestamp"  by RootObject.ProcessName
| sort limit=100000 RootObject.ProcessName
| fields - _span
| rename RootObject.ProcessName AS ProcessName
| fillnull "Count of timestamp"
| fields ProcessName, "Count of timestamp"
| sort -"Count of timestamp"

I get this:

alt text

Thank you.
Bogdan

0 Karma

marycordova
SplunkTrust
SplunkTrust
index=webtrafic 
| stats dedup_splitvals=t count(timestamp) AS "Count of timestamp"  by ProcessName
| fillnull "Count of timestamp" value="0"
| sort - "Count of timestamp"
| head 5
| chart "Count of timestamp" by ProcessName
@marycordova
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...