Archive

I have a seach command but i need to remove the percent column

New Member

I have a command that gives me the correct info what i want which is
(eventtype="wineventlog_system") source="inEventLog:" (host="" OR ComputerName="") TaskCategory="" SourceName="" EventCode="*" (Type="Error" OR Type="Warning") * | sort -count | top limit=5 host
this displays a percent column which i want to remove and I have tried to use | top host showperc=f but it doesnt work I have tried to use the showperc=f in many formats and it changes the bar chart wrong and doesnt remove the result column.

Can someone help with the last part to remove the percentage column but still display the right bar chart.

Tags (1)
0 Karma
1 Solution

Ultra Champion

Just add that inside the initial topcommand, don't add an additional top command.

(eventtype="wineventlog_system") source="inEventLog:" (host="*" OR ComputerName="*") TaskCategory="*" SourceName="*" EventCode="*" (Type="Error" OR Type="Warning") | sort -count | top showperc=f limit=10 host

View solution in original post

0 Karma

Ultra Champion

Just add that inside the initial topcommand, don't add an additional top command.

(eventtype="wineventlog_system") source="inEventLog:" (host="*" OR ComputerName="*") TaskCategory="*" SourceName="*" EventCode="*" (Type="Error" OR Type="Warning") | sort -count | top showperc=f limit=10 host

View solution in original post

0 Karma

New Member

your a star!

0 Karma

Ultra Champion

It seems to work fine for me when I add showperc=f to a search like that. Is that bar chart part of a dashboard? Or are you running this as an ad hoc search and then opening the visualization panel?

0 Karma

New Member

Hi, how are you adding the showperc=f like this?
(eventtype="wineventlog_system") source="inEventLog:" (host="" OR ComputerName="") TaskCategory="" SourceName="" EventCode="*" (Type="Error" OR Type="Warning") * | sort -count | top limit=10 host | top hosts showperc=f

when I add this to my search the bar chart doesn't show the true info afterwards they all display 1 count only.
yes the bar chart is part of the dashboard.

0 Karma