Splunk Search
Highlighted

How to do this subsearch?

Contributor

Hi~there, i have logs containing "requestURL" and its "Category" per event. it's easy to count top 10 requestURL, and it displays the table containing "requestURL","count","percent" fileds. now if i wanna append one column named Category in each top 10 row. how can i do this search? or must use lookup table? thanks for your kind help 🙂

Tags (1)
0 Karma
Highlighted

Re: How to do this subsearch?

Legend

Just add "Category" as a parameter to top:

<yourbasesearch> | top 10 requestURL,Category

This gives you the top 10 pairs of requestURL and Category, so if one requestURL would have different values for Category these would be split up, but I'm guessing that is not likely to happen in your logs.

View solution in original post

Highlighted

Re: How to do this subsearch?

Contributor

Thanks,Ayn. i thought top command just use only one field to caculate.i didn't expect it can do such thing.

0 Karma