Splunk Search

How to query where I can display x and y values as the top value?

abhi04
Communicator

I have a tag which has four values i.e. a,b,x,y. But I want to display only the x and y values as the top value. I tried the below query but it is not working.

Source title=webatm* | eval t=if(tag==x OR tag==y)|top t
0 Karma
1 Solution

micahkemp
Champion

Try:

 | eval t=if(tag="x" OR tag="y", tag, NULL)|top t

Inside an if (or other eval function), an un-quoted string represents a field name, and a quoted string represents the string itself.

Or, for multivalue fields, try:

| eval t=mvfilter(match(tag, "x") OR match(tag, "y"))
| top t

View solution in original post

0 Karma

micahkemp
Champion

Try:

 | eval t=if(tag="x" OR tag="y", tag, NULL)|top t

Inside an if (or other eval function), an un-quoted string represents a field name, and a quoted string represents the string itself.

Or, for multivalue fields, try:

| eval t=mvfilter(match(tag, "x") OR match(tag, "y"))
| top t
0 Karma

abhi04
Communicator

Hi micahkemp,

The above query is including all the values a,b,x,y and not x,y only.
It's returning same as below query.
Source type=webatm*|top tag

I want only x and y values.

0 Karma

micahkemp
Champion

It doesn't when I run it:

| makeresults count=6| eval tag="x"
| append [| makeresults count=10 | eval tag="y"]
| append [| makeresults count=20 | eval tag="z"]
| eval t=if(tag="x" OR tag="y", tag, NULL)|top t

Is your tag value a multivalue field, perhaps, where one event has multiple values for tag? If that is the case try this instead:

| eval t=mvfilter(match(tag, "x") OR match(tag, "y"))
|top t
0 Karma

abhi04
Communicator

Thanks Micahkemp.

It was anmultivalue field and the mvfilter is working.
Appreciated your help.Thanks a ton

0 Karma

micahkemp
Champion

Great! I've added the mvfilter version to my answer. If that answer solves your issue, please accept it so the question no longer appears open, and others have an easier time finding the answer.

0 Karma

abhi04
Communicator

It still shows the percentage among all the values i.e. a,b,x,y and not between x and y only.

The above query result shows the same as below query

Source type=webatm* |top tag

But this is including all a,b,x and y values which I don't want.

0 Karma
Get Updates on the Splunk Community!

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...