https://community.splunk.com/t5/Splunk-Dev/Building-top-with-log-source-where-values-are-given-with-a/m-p/490569#M8820 <P>Delimiter ":" or "=" is set during parsing of your logs before indexing them. For existing data you need to extract value using rex and then do top.</P> <PRE><CODE>index=INDEX_NAME "from:" | rex "from:\s*(?&lt;from&gt;[\w]+)" | top limit=10 from </CODE></PRE> Wed, 11 Mar 2020 15:42:05 GMT manjunathmeti 2020-03-11T15:42:05Z https://community.splunk.com/t5/Splunk-Dev/Building-top-with-log-source-where-values-are-given-with-a/m-p/490568#M8819 <P>I’ve got trouble to build a top with log source, where the from value is given by "from*<EM>:</EM><EM>" and not “from</EM><EM>=</EM>*"</P> <P>That way I just got 0 results, using “index="myindex" "from:"| top limit=10 from”<BR /> I’ve tried with rename and replace, but no success. How can I tell Splunk that the delimiter is “:” and not “=” for the search value? Or how can I replace/rename the result and then build a top over the result?</P> Wed, 30 Sep 2020 04:32:47 GMT https://community.splunk.com/t5/Splunk-Dev/Building-top-with-log-source-where-values-are-given-with-a/m-p/490568#M8819 dschuermann 2020-09-30T04:32:47Z https://community.splunk.com/t5/Splunk-Dev/Building-top-with-log-source-where-values-are-given-with-a/m-p/490569#M8820 <P>Delimiter ":" or "=" is set during parsing of your logs before indexing them. For existing data you need to extract value using rex and then do top.</P> <PRE><CODE>index=INDEX_NAME "from:" | rex "from:\s*(?&lt;from&gt;[\w]+)" | top limit=10 from </CODE></PRE> Wed, 11 Mar 2020 15:42:05 GMT https://community.splunk.com/t5/Splunk-Dev/Building-top-with-log-source-where-values-are-given-with-a/m-p/490569#M8820 manjunathmeti 2020-03-11T15:42:05Z