Splunk Search

How can I have the query when the field have the % (same pictures)

Joycetran
New Member

alt text
I have the field count number and %, How can I set the query to run?

Tags (1)
0 Karma
1 Solution

niketn
Legend

@Joycetran this is the use case of top command

<yourCurrentSearch>
| top <yourFieldName>

Here is a run anywhere search example based on Splunk's _internal index

index=_internal sourcetype=splunkd component=*
| top component
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

@Joycetran this is the use case of top command

<yourCurrentSearch>
| top <yourFieldName>

Here is a run anywhere search example based on Splunk's _internal index

index=_internal sourcetype=splunkd component=*
| top component
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Joycetran
New Member

Thank you. It works.

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...