topic Re: Customizing statics and visualization for the user given filter in Splunk Search

Customizing statics and visualization for the user given filter

karthickmoorthy — Thu, 03 Apr 2014 21:22:35 GMT

Hi,

I have 4 event filed in a single line, now I need to filter the top 200 event for a particular event filed , which I can do by using " | top=200 ", mu main problem is in the statics and visualization it showing only the event and their count, I would like to have all the remaining 3 event filed which comes with it the data.

In the Table I would like to use the filter is it possible ??? like ordering..??

Thanks in advance.

Re: Customizing statics and visualization for the user given filter

somesoni2 — Thu, 03 Apr 2014 21:31:13 GMT

can your provide your current search (before applying top command)?

Re: Customizing statics and visualization for the user given filter

somesoni2 — Thu, 03 Apr 2014 21:39:44 GMT

Try something like this

<your base search> [search <your base search> | top limit=200 fieldX | table fieldX] |...remaning search

The subsearch will eliminate other values of fieldX which are not part of top 200.

Re: Customizing statics and visualization for the user given filter

karthickmoorthy — Mon, 28 Sep 2020 16:18:54 GMT

@somesoni2

host=PDT DataTag=HistoryData "Scanned_Network: .Channel"=44| top limit=200 "Scanned_Network: .SSID"

In statics and visualization it providing only SSID,count,percentage. I dont want percentage instead of that I want other event fields. and I also would like to know how to customize the visualization graph.. example instead of count I would like to have event field.

Re: Customizing statics and visualization for the user given filter

karthickmoorthy — Mon, 28 Sep 2020 16:19:00 GMT

Hi
host=PDT DataTag=HistoryData [ search host=PDT DataTag=HistoryData | top limit=200 Scanned_Network: .SSID | table Scanned_Network: .SSID] It returns no result, I am sure there is a data. at all time.
My doubt is when I use the top command it will table only one field in statics and visualization, How to add other fields in statics ??