I'm using the top command and wanted the generated chart to show the percent value for each of the items instead of the count. The documentation doesn't say how to do this and I couldn't find an answer by searching this forum, but I eventually figured out a way to do it which I'll post here as an answer in case others have the same need.
Use table
to reorder the results. The graph results view seems to simply grab the first two fields in the generated table and then use the first field as its X axis and the second field for Y axis. So, the following will do the trick:
... | top field | table field percent
Use table
to reorder the results. The graph results view seems to simply grab the first two fields in the generated table and then use the first field as its X axis and the second field for Y axis. So, the following will do the trick:
... | top field | table field percent
Thanks, that works too.
or just
... | top showcount=false fieldForTop
To show only the percent field. To show only the count field:
... | top showperc=false fieldForTop
Or you can always pipe to the fields command
... | top fieldForTop | fields - count
... | top fieldForTop | fields - percent
At least w/ Splunk 4.3.1, which we're using, doing the above doesn't work -- it shows an empty chart.
To be clear, I'm talking specifically about the Results Chart view of the top output, not the Table view for which your solution works.
Here's how to do it:
... | top showcount=false percentfield=count ...
This works because the chart is hardcoded to display the "count" value.