Splunk Search

How to sort events by number of occurances?

letharion
Engager

I'm trying to do

"[Simple text search]" | top limit=50 count

To so the 50 highest occurrences of my search for which ever time resolution I'm search by.

This gives me

Error in 'top' command: The output count field conflicts with the input field 'count'. Use the 'countfield' option to specify a different name.

Tags (1)
0 Karma
1 Solution

letharion
Engager

"[Simple text search]" | timechart count

gave me what I wanted. Lacking the limit, but that's fine for me.

View solution in original post

0 Karma

letharion
Engager

"[Simple text search]" | timechart count

gave me what I wanted. Lacking the limit, but that's fine for me.

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...