How do I edit my search to make a change to the resulting output?

[puneetkharband1]

My search:

index="ABC" sourcetype=* Customers=ABCD | top limit=1 Customers

Output is:

ABCD  233322

I want only 233322 to display as a stat because I am displaying it on a page for each customer

So please suggest the best way to display this.

[fdi01]

try like:

index="ABC" sourcetype=*  | stats count(eval(Customers="ABCD"))  as "count of ABCD"

[puneetkharband1]

I am sorry I tried this but this gives me 0 value 😞

[stephanefotso]

Hello! Try this:

index="ABC" sourcetype=* Customers=ABCD | top limit=1 Customers |table count

Thanks

[puneetkharband1]

This works too !!

[stephanefotso]

Thanks. And i was thinking that you was only look at the count value 233322. Isn't it? Because i think that the top command will give the count and also the percent fields!

[woodcock · Accepted solution]

Try this:

index="ABC" sourcetype=* Customers=ABCD | top limit=1 Customers | fields - Customers