topic I have a seach command but i need to remove the percent column in Splunk Search

I have a seach command but i need to remove the percent column

pboon — Fri, 12 Jul 2019 08:06:31 GMT

I have a command that gives me the correct info what i want which is
(eventtype="wineventlog_system") source="inEventLog:" (host="" OR ComputerName="") TaskCategory="" SourceName="" EventCode="*" (Type="Error" OR Type="Warning") * | sort -count | top limit=5 host
this displays a percent column which i want to remove and I have tried to use | top host showperc=f but it doesnt work I have tried to use the showperc=f in many formats and it changes the bar chart wrong and doesnt remove the result column.

Can someone help with the last part to remove the percentage column but still display the right bar chart.

Re: I have a seach command but i need to remove the percent column

FrankVl — Fri, 12 Jul 2019 08:28:50 GMT

It seems to work fine for me when I add showperc=f to a search like that. Is that bar chart part of a dashboard? Or are you running this as an ad hoc search and then opening the visualization panel?

Re: I have a seach command but i need to remove the percent column

pboon — Fri, 12 Jul 2019 08:37:52 GMT

Hi, how are you adding the showperc=f like this?
(eventtype="wineventlog_system") source="inEventLog:" (host="" OR ComputerName="") TaskCategory="" SourceName="" EventCode="*" (Type="Error" OR Type="Warning") * | sort -count | top limit=10 host | top hosts showperc=f

when I add this to my search the bar chart doesn't show the true info afterwards they all display 1 count only.
yes the bar chart is part of the dashboard.

Re: I have a seach command but i need to remove the percent column

FrankVl — Fri, 12 Jul 2019 08:54:14 GMT

Just add that inside the initial topcommand, don't add an additional top command.

(eventtype="wineventlog_system") source="inEventLog:" (host="*" OR ComputerName="*") TaskCategory="*" SourceName="*" EventCode="*" (Type="Error" OR Type="Warning") | sort -count | top showperc=f limit=10 host

Re: I have a seach command but i need to remove the percent column

pboon — Fri, 12 Jul 2019 11:19:33 GMT

your a star!