Top highest value on dashboard

[Sarro]

Hello everyone !

I’ve a use case that I can’t resolve of my own. Here it is:

• Every minute I get some logs via an input (let’s call it “MetricInput”)
• In each logs, there is a field named “name” and an other named “value”
• I want in my dashboard the top 5 highest “value” with the “name” associated (and not the top 5 of the most represented value like does the Quick Chart widget)

It is possible? If it is: how? Else: is there a solution?

Regards.

[GTownson (GT)]

Hi Sarro,

If you are indexing the field ‘value’ as an integer then you will be able to show to top values by using the ‘statistics’ button below ‘quick values’

In my case below, the field is stored as a string and therefore the statistics don’t work as I’d like, but you can probably get an idea of what the output would be.

Regards,

G

[Sarro]

Thanks for your response @GTownson !

I understand what you mean but I’m not sure if that answer my problem. With your method I can only see the only one top value (thanks to the ‘maximum’ column) and not the first 5 or 10 values. Do I understand you correctly?

Regards.

[GTownson (GT)]

Ah yes, I understand what you mean now.

With my solution you will only be able to see the single maximum value for that search.

A work around would be to export the search output as csv and then open the file in excel. You could then set filters on the header row and sort A-Z. This method is quite long winded, but it would work if you just wanted to find the top values a few times.

Regards,

George

[Sarro]

Mmm I see. Thanks for your time. I hope this functionnality will come out soon.

Regards

[jan (Jan Doberstein)]

if that function is not given, feel free to create a feature issue over at

Graylog2/graylog2-server

Please include some context that we are able to understand that request and the possible benefit that other - not you - might have with that.

[Sarro]

Sorry for the late answer. I will do that in the week