Splunk Search

How can I have the query when the field have the % (same pictures)

Joycetran
New Member

alt text
I have the field count number and %, How can I set the query to run?

Tags (1)
0 Karma
1 Solution

niketn
Legend

@Joycetran this is the use case of top command

<yourCurrentSearch>
| top <yourFieldName>

Here is a run anywhere search example based on Splunk's _internal index

index=_internal sourcetype=splunkd component=*
| top component
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

@Joycetran this is the use case of top command

<yourCurrentSearch>
| top <yourFieldName>

Here is a run anywhere search example based on Splunk's _internal index

index=_internal sourcetype=splunkd component=*
| top component
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Joycetran
New Member

Thank you. It works.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Data Persistence in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. What happens if the OpenTelemetry collector ...

Introducing Splunk 10.0: Smarter, Faster, and More Powerful Than Ever

Now On Demand Whether you're managing complex deployments or looking to future-proof your data ...

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...