Splunk Search

Limit Search Results in Chart to Top 10

dmmaloy
New Member

I have a search that returns results for the previous three months for multiple entities. Due to the large number of entities I want to limit the search to the top 10.
This is the search:
sourcetype=escada_message Message=FAILED AOR_Group=Gas NOT ACKNOWLEDGD NOT DELETED | rex field=Message "(?[A-Za-z]+\s[A-Za-z]+)" | eval Month=strftime(_time,"%m/%Y") | chart count over Message by Month

Tags (2)
0 Karma

nickhills
Ultra Champion
sourcetype=escada_message Message=FAILED AOR_Group=Gas NOT ACKNOWLEDGD NOT DELETED 
| rex field=Message "(?[A-Za-z]+\s[A-Za-z]+)" 
| eval Month=strftime(_time,"%m/%Y") 
| chart count over Message by Month limit=10 useother=false

This will give the top 10 months - possibly not what you are after, so switch the chart round for the top 10 messages

sourcetype=escada_message Message=FAILED AOR_Group=Gas NOT ACKNOWLEDGD NOT DELETED 
| rex field=Message "(?[A-Za-z]+\s[A-Za-z]+)" 
| eval Month=strftime(_time,"%m/%Y") 
| chart count over Month by Message limit=10 useother=false

useother=false prevents the output from rolling up other values into 'other'

If my comment helps, please give it a thumbs up!

dmmaloy
New Member

Using Message by Month doesn't reduce the number of results. Month by Message reduces the results but the results are organized by month.
I need it to display each station's monthly totals together to be viewed in a trend pattern by station.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...