https://community.splunk.com/t5/Splunk-Search/Top-Fields-command/m-p/417013#M120013 <P>Your query is fetching top 5 sessionID for each host (all hosts will be shown). What was your requirement? </P> <P>Regarding removing the fields, the percent field name is misspelled (written as precent) hence it's not removed. For removing count, try to use field name count itself. (try <CODE>| fields - count, percent</CODE>)</P> Tue, 16 Apr 2019 14:41:20 GMT somesoni2 2019-04-16T14:41:20Z https://community.splunk.com/t5/Splunk-Search/Top-Fields-command/m-p/417012#M120012 <PRE><CODE>index=uberAgent | top 5 SessionID by host | fields - Anzahl, precent </CODE></PRE> <P>This code returns all events in the index instead of five and removes no counts and percent fields. Who can be the problem?<span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/6912i80AAF9BAACD89F2D/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Tue, 16 Apr 2019 09:00:58 GMT https://community.splunk.com/t5/Splunk-Search/Top-Fields-command/m-p/417012#M120012 anasshsa 2019-04-16T09:00:58Z https://community.splunk.com/t5/Splunk-Search/Top-Fields-command/m-p/417013#M120013 <P>Your query is fetching top 5 sessionID for each host (all hosts will be shown). What was your requirement? </P> <P>Regarding removing the fields, the percent field name is misspelled (written as precent) hence it's not removed. For removing count, try to use field name count itself. (try <CODE>| fields - count, percent</CODE>)</P> Tue, 16 Apr 2019 14:41:20 GMT https://community.splunk.com/t5/Splunk-Search/Top-Fields-command/m-p/417013#M120013 somesoni2 2019-04-16T14:41:20Z https://community.splunk.com/t5/Splunk-Search/Top-Fields-command/m-p/417014#M120014 <P>@somesoni2 actually better would be to use <CODE>showperc=f</CODE> and <CODE>showcount=f</CODE> arguments in the top command itself.</P> <PRE><CODE>| top 5 SessionID by host showperc=f showcount=f </CODE></PRE> <P>@anasshsa your query id giving you top 5 sessions for each host. If that is your requirement you can try the following:</P> <PRE><CODE> index=uberAgent | top 5 SessionID by host showperc=f | xyseries host SessionID count </CODE></PRE> <P>Please let us know if you are looking for something else.</P> Tue, 16 Apr 2019 16:17:31 GMT https://community.splunk.com/t5/Splunk-Search/Top-Fields-command/m-p/417014#M120014 niketn 2019-04-16T16:17:31Z