- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Display the "others" or the rest after showing...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have this search to show top 5 values:
search... | fields ALARM | stats count by ALARM | sort limit=5 -count
Result for above is shown in a dashboard as a pie chart. How do I search for the rest of ALARM to show in a separate pie chart? Values for ALARM vary depending on time range.
Sorry if duplicate, did not find a similar question.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try like this
search... | fields ALARM | top limit=5 useother=t showperc=f ALARM
Updated
Try this. This will exclude top 5 and give the rest (streamstats will assign rank/serial no to sorted list and then we filter top 5)
search...| fields ALARM | stats count by ALARM | sort 0 -count | streamstats count as rank | where rank>5 | fields - rank
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
search...
| fields ALARM
| stats count by ALARM
| search NOT [search... | fields ALARM | stats count by ALARM | sort limit=5 -count | table ALARM]
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
this works if my time range is set to past 3 days where there are less than 1M events, however, when I tried past 30 days with 10M events, it pulled up all ALARM values
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
sorry, this actually works, forgot to add the table ALARM at the end. however, this takes twice the time as compared to somesoni2's - thank you!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That makes sense - it's doing twice the work!
Wouldn't have posted it at all if somesoni2's second answer had been posted yet.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try like this
search... | fields ALARM | top limit=5 useother=t showperc=f ALARM
Updated
Try this. This will exclude top 5 and give the rest (streamstats will assign rank/serial no to sorted list and then we filter top 5)
search...| fields ALARM | stats count by ALARM | sort 0 -count | streamstats count as rank | where rank>5 | fields - rank
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
this pulled up the top 5 and "other" values for ALARM
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I didn't fully read I guess. Try the updated answer.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
thank you, this works.
More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk
.conf24 | Personalize your .conf experience with Learning Paths!
Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...
