Show percent instead of count in top chart

[ctoo]

I'm using the top command and wanted the generated chart to show the percent value for each of the items instead of the count. The documentation doesn't say how to do this and I couldn't find an answer by searching this forum, but I eventually figured out a way to do it which I'll post here as an answer in case others have the same need.

[Ayn · Accepted solution]

Use table to reorder the results. The graph results view seems to simply grab the first two fields in the generated table and then use the first field as its X axis and the second field for Y axis. So, the following will do the trick:

... | top field | table field percent

[ctoo]

Thanks, that works too.

[lguinn2]

or just

... | top showcount=false fieldForTop

To show only the percent field. To show only the count field:

... | top showperc=false fieldForTop

Or you can always pipe to the fields command

... | top  fieldForTop | fields - count

... | top  fieldForTop | fields - percent

[ctoo]

At least w/ Splunk 4.3.1, which we're using, doing the above doesn't work -- it shows an empty chart.

To be clear, I'm talking specifically about the Results Chart view of the top output, not the Table view for which your solution works.

[ctoo]

Here's how to do it:

... | top showcount=false percentfield=count ...

This works because the chart is hardcoded to display the "count" value.