Splunk Search

How to sort events by number of occurances?

letharion
Engager

I'm trying to do

"[Simple text search]" | top limit=50 count

To so the 50 highest occurrences of my search for which ever time resolution I'm search by.

This gives me

Error in 'top' command: The output count field conflicts with the input field 'count'. Use the 'countfield' option to specify a different name.

Tags (1)
0 Karma
1 Solution

letharion
Engager

"[Simple text search]" | timechart count

gave me what I wanted. Lacking the limit, but that's fine for me.

View solution in original post

0 Karma

letharion
Engager

"[Simple text search]" | timechart count

gave me what I wanted. Lacking the limit, but that's fine for me.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...