Splunk Search

How can I have the query when the field have the % (same pictures)

Joycetran
New Member

alt text
I have the field count number and %, How can I set the query to run?

Tags (1)
0 Karma
1 Solution

niketn
Legend

@Joycetran this is the use case of top command

<yourCurrentSearch>
| top <yourFieldName>

Here is a run anywhere search example based on Splunk's _internal index

index=_internal sourcetype=splunkd component=*
| top component
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

@Joycetran this is the use case of top command

<yourCurrentSearch>
| top <yourFieldName>

Here is a run anywhere search example based on Splunk's _internal index

index=_internal sourcetype=splunkd component=*
| top component
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Joycetran
New Member

Thank you. It works.

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...