Splunk Search

How to use an additional conditional with the top command (ex: count > 10) and add a sequential number column to the table?

okug
New Member

Hi,

I have questions about the top command.

First one is pretty simple.
How I can add sequential number column in top result table?

2nd one is.
Is there any way to use an additional conditional to top command? I want to do something like:
top limit=30 and percent > 1 ....
top limit=50 and count >= 10 ....

Thanks!

0 Karma
1 Solution

satishsdange
Builder

| top limit=30 xxx | where count > 10

View solution in original post

pradeepkumarg
Influencer

Try this..

| top limit=30 | eval s_no =1 | accum s_no
| top limit=30 | where percent > 1
| top limit=30 | where count >= 10
0 Karma

satishsdange
Builder

| top limit=30 xxx | where count > 10

okug
New Member

Great! Thanks!!
Any idea for 1st question?

0 Karma

ppablo
Community Manager
Community Manager

Hi @okug

Try and see if the answer on this post can help answer your 1st question.
http://answers.splunk.com/answers/216542/how-to-add-a-first-column-to-number-each-row-in-a.html

0 Karma

okug
New Member

Thanks!

top limit=30 foo| where percent >= 1 | streamstats count as row | fields row,foo,count,percent

worked.

0 Karma

ppablo
Community Manager
Community Manager

Hi @okug

Great 🙂 glad it worked!

0 Karma
Get Updates on the Splunk Community!

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Want a chance to win $500 to the Splunk shop? Take our IT Incident Management Survey!

  Top Trends & Best Practices in Incident ManagementSplunk is partnering up with Constellation Research to ...