Splunk Search

How can I have the query when the field have the % (same pictures)

Joycetran
New Member

alt text
I have the field count number and %, How can I set the query to run?

Tags (1)
0 Karma
1 Solution

niketnilay
Legend

@Joycetran this is the use case of top command

<yourCurrentSearch>
| top <yourFieldName>

Here is a run anywhere search example based on Splunk's _internal index

index=_internal sourcetype=splunkd component=*
| top component
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketnilay
Legend

@Joycetran this is the use case of top command

<yourCurrentSearch>
| top <yourFieldName>

Here is a run anywhere search example based on Splunk's _internal index

index=_internal sourcetype=splunkd component=*
| top component
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

Joycetran
New Member

Thank you. It works.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!