https://community.splunk.com/t5/Splunk-Search/Append-Columns-to-Top-Output/m-p/289389#M162037 <P>Hey</P> <P>Can you use eventstats before doing the count?</P> <PRE><CODE> `nagios_index` `nagios_core_sourcetype` host_name="*" ((eventname="SERVICE ALERT" NOT status_code="OK") OR (eventname="HOST ALERT" NOT status_code="UP")) | eval name=if(eventname=="HOST ALERT","Host",service) | eventstats count(whatever_you_want_to_count) as CountField | top eventname,host_name,name,CountField limit="100" </CODE></PRE> Mon, 26 Mar 2018 10:20:58 GMT tiagofbmm 2018-03-26T10:20:58Z https://community.splunk.com/t5/Splunk-Search/Append-Columns-to-Top-Output/m-p/289388#M162036 <P>Hi,</P> <P>I have the following search and I would like to enumerate a total event count prior to the Top function and then append it to the results:</P> <PRE><CODE>`nagios_index` `nagios_core_sourcetype` host_name="*" ((eventname="SERVICE ALERT" NOT status_code="OK") OR (eventname="HOST ALERT" NOT status_code="UP")) | eval name=if(eventname=="HOST ALERT","Host",service) | top eventname,host_name,name limit="100" </CODE></PRE> <P>The macro's at the start just specify the index and sourcetype. From what I can tell there is no way to append columns to Top's output? Any help on the best way to achieve the desired output would be greatly appreciated!</P> <P>Cheers</P> Mon, 26 Mar 2018 10:13:03 GMT https://community.splunk.com/t5/Splunk-Search/Append-Columns-to-Top-Output/m-p/289388#M162036 samhodgson 2018-03-26T10:13:03Z https://community.splunk.com/t5/Splunk-Search/Append-Columns-to-Top-Output/m-p/289389#M162037 <P>Hey</P> <P>Can you use eventstats before doing the count?</P> <PRE><CODE> `nagios_index` `nagios_core_sourcetype` host_name="*" ((eventname="SERVICE ALERT" NOT status_code="OK") OR (eventname="HOST ALERT" NOT status_code="UP")) | eval name=if(eventname=="HOST ALERT","Host",service) | eventstats count(whatever_you_want_to_count) as CountField | top eventname,host_name,name,CountField limit="100" </CODE></PRE> Mon, 26 Mar 2018 10:20:58 GMT https://community.splunk.com/t5/Splunk-Search/Append-Columns-to-Top-Output/m-p/289389#M162037 tiagofbmm 2018-03-26T10:20:58Z