Splunk Search

Putting count first in top results

willthames
Path Finder

I would like count to be the first field when I use top, rather than the last (one of my fields is very long and so count scrolls off the right hand side)

I've tried

sourcetype="server" | top limit=10 count, status, message

But that reports a clash in name between input and output field

Error in 'top' command: The output count field conflicts with the input field 'count'. Use the 'countfield' option to specify a different name.

If I try

sourcetype="server" | top limit=10 countfield=countxz countxz, status, message

I get the same message.

Tags (1)

gkanapathy
Splunk Employee
Splunk Employee
sourcetype="server" | top limit=10 countfield=countxz count, status, message
0 Karma

carasso
Splunk Employee
Splunk Employee

i can't tell if the question is the result of him having a field called "count" as you think, or whether he just wants the "count" field to be the first field. "top" returns fields as ", count, percent"

0 Karma

carasso
Splunk Employee
Splunk Employee
sourcetype="server" | top 10 status message | fields count, percent, status, message
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...