topic Re: Top Command not Returning Results in Splunk Search

Top Command not Returning Results

SMM10 — Wed, 24 Nov 2021 19:21:03 GMT

I am using a chart command to get a list of IP's and servers with an error. I am attempting to only get the top 10 results. For some reason when I do the top for IP I do not get results but if I do it for server I get results.

index=foo result=error | chart count by server, ip | top limit=10 ip

Re: Top Command not Returning Results

somesoni2 — Wed, 24 Nov 2021 19:39:20 GMT

Once you run your chart command, you get one column for server and a column each for different ips in your result (column name will the value of ip), but there is no field called "ip" hence your top command fails. (it works for field server as it exists.

Assuming you want to get top 'ip' based on count, try something like this

index=foo result=error | top limit=10 ip

Re: Top Command not Returning Results

SMM10 — Wed, 24 Nov 2021 20:01:06 GMT

Doing that though loses the chart formatting that I wanted. IP's as the columns with servers as the rows. I would like to keep the chart formatting.

Re: Top Command not Returning Results

somesoni2 — Wed, 24 Nov 2021 20:17:57 GMT

So do you want to show only the ip (as columns) which have top 10 total count of errors (across all servers)?

Re: Top Command not Returning Results

SMM10 — Fri, 26 Nov 2021 14:19:10 GMT

Yes so the two rows should be servers and the columns should be the individual IP. For context this is from one of the learning labs so I believe I need to use chart and cant bypass it. I find it more strange that i can get the server name to show; though its only two values but the IP doesn't.