Use transforming command on all events

[flow2k]

In Searching, it looks like it is not possible to use a transforming command directly. For example, I would like find the most common host values across all events, so I do
top host

But this is not a valid query.

Would I really have to do
* | top host
Is this the preferred way to do what I want?

[mayurr98 · Accepted solution]

Hey you can try something like this

index=* | top host

The above query will be much slower if you want to get results faster then you can try tstats command.

| tstats count where index=* by host | sort- count

Let me know if this helps!