I'm attempting to identify the top 5 hosts responsible for my errors via the following query: sourcetype=logs [ search sourcetype=logs | top 0 errors showperc=false showcount=false ] | top 5 hosts by errors showperc=false This query works, but gives me results for a ton of errors. I would like to limit the results to only errors per host that are greater than a count of 10. However when I add the following line to my query, I get no results: | search count > 10 I know that I have results that are > 10, so this logic is valid, but I cannot figure out how to properly apply it. Here's a sample of what my results look like: - host - error - count - APP01 - err09 - 50 - APP01 - err07 - 38 - APP01 - err05 - 27 - APP01 - err10 - 20 - APP01 - err12 - 4 - APP02 - err15 - 33 - APP02 - err60 - 21 - APP02 - err09 - 8 ... Any ideas on how to remove the rows with counts that are not greater than 10? ... View more

I have a video player that logs the following: Video Starts - When a user clicks play and the first frame of the video is delivered Video Start Errors - When a user clicks play and the first frame of the video is not delivered (due to an error) Playback Errors - When a user clicks play, and the first frame of the video is delivered, and an error is thrown any time after Please note the following two events are NOT logged: user closes the video, or the video naturally completes playback. I've successfully created a query that shows the total user "attempts" to play a video (presented on a Splunk dashboard), and graphs the results in a pie chart split into two chunks: A. Successful Video Playback Sessions B. Errored Out Video Sessions I have the above accomplished thus far, but I also need a the table of the results (same query, different panel and panel visualization type on the dashboard) to display the % each of the above A and B) represent vs. the total attempts. I'm calculating A and B via the following query: sourcetype=videoplaybacklog | stats count(eval(event="VIDEO_START")) as VS, count(eval(event="PLAYBACK_ERROR")) as PE, count(eval(event="VIDEO_START_ERROR")) as VSE | eval A=VS-PE | eval B=VSE+PE | table A B | transpose | rename column as Type | rename "row 1" as "count" This query gives me the pie chart I need in the first dashboard chart panel, but not the % in table that I need in the second dashboard table panel. I've tried the TOP command (instead of table) and adding in the logic to show the % A and B represent of the total attempts, but the top command returns the results in a single row, and doesn't graph nicely in the pie chart. Any suggestions? ... View more