Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to get TOP 3 values from STATS list()

$
0
0
Hello Everyone, I am trying to get the top 3 max values of a field "elapseJobTime" for all the instances associated with the field "desc". In order to achieve this, I first sorted the field "elapseJobTime" in descending order and then executed the STATS command to list out the values of all the respective fields I was looking for. I am getting the output in the sequence as expected but the only issue is that my search lists down 100's of values for the fields JOBNAME JOBID elapseJobTime but I want to restrict my output to just top 3 values. I tried to use HEAD 3 after the STATS but no luck. Please assist. | sort -elapseJobTime | stats list(JOBNAME) as JOBNAME list(JOBID) as JOBID list(elapseJobTime) as elapseJobTime by desc The output should be like desc JOBNAME JOBID elapseJobTime desc1 JOB1 J1 .31 JOB1 J2 .27 JOB3 J3 .27 desc2 JOB4 J4 .71 JOB5 J5 .11 JOB5 J6 .10 Thank you Rajat

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>