Splunk Search

Display only the top 5 values in count column

sphiwee
Contributor

sphiwee_1-1599604516265.png

Id like to be able to display only the top Total values, struggling with this

Labels (3)
Tags (1)
0 Karma
1 Solution

anthonymelita
Contributor

just adding "| head 5" will keep the top five values of whatever column the results are sorted on. In his screenshot that appears to be host. 
To keep the top 5 Total do, "|sort - Total |head 5"

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

|  head 5

anthonymelita
Contributor

just adding "| head 5" will keep the top five values of whatever column the results are sorted on. In his screenshot that appears to be host. 
To keep the top 5 Total do, "|sort - Total |head 5"

sphiwee
Contributor

Is it possible to hide the total column?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| fields - Total
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...