I have a seach command but i need to remove the percent column

[pboon]

I have a command that gives me the correct info what i want which is
(eventtype="wineventlog_system") source="inEventLog:" (host="" OR ComputerName="") TaskCategory="" SourceName="" EventCode="*" (Type="Error" OR Type="Warning") * | sort -count | top limit=5 host
this displays a percent column which i want to remove and I have tried to use | top host showperc=f but it doesnt work I have tried to use the showperc=f in many formats and it changes the bar chart wrong and doesnt remove the result column.

Can someone help with the last part to remove the percentage column but still display the right bar chart.

[FrankVl · Accepted solution]

Just add that inside the initial topcommand, don't add an additional top command.

(eventtype="wineventlog_system") source="inEventLog:" (host="*" OR ComputerName="*") TaskCategory="*" SourceName="*" EventCode="*" (Type="Error" OR Type="Warning") | sort -count | top showperc=f limit=10 host

[pboon]

your a star!

[FrankVl]

It seems to work fine for me when I add showperc=f to a search like that. Is that bar chart part of a dashboard? Or are you running this as an ad hoc search and then opening the visualization panel?

[pboon]

Hi, how are you adding the showperc=f like this?
(eventtype="wineventlog_system") source="inEventLog:" (host="" OR ComputerName="") TaskCategory="" SourceName="" EventCode="*" (Type="Error" OR Type="Warning") * | sort -count | top limit=10 host | top hosts showperc=f

when I add this to my search the bar chart doesn't show the true info afterwards they all display 1 count only.
yes the bar chart is part of the dashboard.