Splunk Search

Top of field with multiple values

adri9valle
New Member

Hi,

I'm trying to do a simple search that returns the top repeated values of a field.

The problem is that this field has multiple values, then when a try to exec the search, it returns 0 results.

With another field with a single value, this problem doesn't happen.

For example, let's suppose that we have this two fields; level and groups the field level contents a unique value for example 7, but the groups field can content multiples values [foo,bar,cir...]

If execute ** query *| top level limit 5 * will return the top 5 levels but if execute ** query | top groups limit 5 ** does not return anything.

How can get the top of a field with multiple values?

Thanks

Tags (1)
0 Karma

adri9valle
New Member

Hi @nickhillscpl and @harishalipaka,

Thanks for your help, but the solution was the below:

Instead of execute:

mysearch | top rules

The execution must be:

mysearch | top rules{}

Looks seem that {} is used for fields with several values.

0 Karma

nickhills
Ultra Champion

I think you mean that the 'group' field can contain comma separated lists of values?

If I have understood that bit correctly, try:

[your search]|makemv delim="," groups|top groups limit 5 
If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...