topic Use transforming command on all events in Splunk Search

Use transforming command on all events

flow2k — Fri, 23 Feb 2018 01:03:28 GMT

In Searching, it looks like it is not possible to use a transforming command directly. For example, I would like find the most common host values across all events, so I do
top host

But this is not a valid query.

Would I really have to do
* | top host
Is this the preferred way to do what I want?

Re: Use transforming command on all events

mayurr98 — Fri, 23 Feb 2018 03:21:35 GMT

Hey you can try something like this

index=* | top host

The above query will be much slower if you want to get results faster then you can try tstats command.

| tstats count where index=* by host | sort- count

Let me know if this helps!