chart query

[DTERM]

The following query

index=test | top Hostname

produces a chart that has percentages included in the chart along with the top hostnames. How do I not include the percentages in the chart? I do not want percentages in the chart.

[ahall_splunk · Accepted solution]

The showperc modifier to the top command is what you want. Here is how you use it:

index=test | top showperc=false Hostname

[Greg_LeBlanc]

You can do:

index=test 
| stats count(_raw) as topHostnames by Hostname 
| sort - topHostnames