topic How to add another field using top limit command? in Splunk Search

How to add another field using top limit command?

grotti — Sun, 17 Sep 2023 19:26:54 GMT

Hello! I need some help from splunkers!!!

I'm using the search index=notable | search status_label=Closed | top limit=5 rule_title in the Splunk Enterprise Security, to list top 10 rule_title values.

But i need to bring the field "comment" of each rule_title in the table.

Can please help me?

Tks!!!

Re: How to add another field using top limit command?

bowesmana — Sun, 17 Sep 2023 23:48:19 GMT

If the comment field is always the same for the rule, then just add the comment to the top command

index=notable | search status_label=Closed | top limit=5 rule_title comment

Re: How to add another field using top limit command?

gcusello — Mon, 18 Sep 2023 06:25:36 GMT

Hi @grotti,

if you haven't too many comments for each row, you could use:

index=notable status_label=Closed | stats values(comment) AS comment BY rule_title | sort 10 -count

Ciao.

Giuseppe