Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: top command with values
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I want top 10 values for a field based on the timer control.
mysearch | top 10 E_Time
above command return top 10 results based on the events count. is there anyway to return top 10 values and display a graph based on these values?
alternatively I can run this search and display the graph
mysearch | table _time E_TIME | sort -E_TIME | head 10 | where len(E_TIME) > 0
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Use head:
... | head 10
EDIT: head will not necessarily return the latest results. The head command will retrieve the first X items from what it's given in the search pipeline. If it's run directly after the initial search command, then you are right, what comes in the search pipeline will be the latest events. If you run it after table though, for instance, it will get the table items and give you the first X of those. So, if you have a table with data that is sorted in the way you want, running head 10 will give you the first 10 items according to that sort order. I believe that's what you wanted.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Use head:
... | head 10
EDIT: head will not necessarily return the latest results. The head command will retrieve the first X items from what it's given in the search pipeline. If it's run directly after the initial search command, then you are right, what comes in the search pipeline will be the latest events. If you run it after table though, for instance, it will get the table items and give you the first X of those. So, if you have a table with data that is sorted in the way you want, running head 10 will give you the first 10 items according to that sort order. I believe that's what you wanted.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Nope, top works with item counts exclusively, so you cannot use it to work with values.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks Ayn, yep you are right I used | head x to get the result. I solved my problem with table | sort | head
buy my question, is it possible to get top 10 E_Time values [not events] using top command?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
No. Updated my answer, please read.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
this will return latest result. I want top 10 values from a particular field.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
May 2026 Splunk Expert Sessions: Security & Observability
Network to App: Observability Unlocked [May & June Series]
SPL2 Deep Dives, AppDynamics Integrations, SAML Made Simple and Much More on Splunk ...
