Splunk Search

What's the difference between using "By" and having another field in top command?

hollybross1219
Path Finder

Don't have a specific example, but would like to understand for my education.

For example, I don't understand what COULD be the difference between listing two fields in the top command versus using the "by" clause. See the following basic examples:

index=sales sourcetype=vendor_sales
| top vendor product name

vs.
index=sales sourcetype=vendor_sales |
top vendor by product name

Tags (1)
0 Karma
1 Solution

13tsavage
Communicator

The answer to your question can be found from this Accepted Answer in Splunk Answers.

https://answers.splunk.com/answers/243063/when-you-feed-multiple-field-names-to-the-top-comm.html

View solution in original post

0 Karma

13tsavage
Communicator

The answer to your question can be found from this Accepted Answer in Splunk Answers.

https://answers.splunk.com/answers/243063/when-you-feed-multiple-field-names-to-the-top-comm.html

View solution in original post

0 Karma

13tsavage
Communicator

I think this old post can help answer your question.

Answer

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Have you looked at the examples in the docs?

---
If this reply helps you, an upvote would be appreciated.
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!