When you feed multiple field names to the top command, what results are returned exactly?

[jli001]

According to Splunk documentation for the top command, it is acceptable to have multiple fields (separated by commas) as arguments. For example:

search something | top host_ip, username

But my brain is having a hard time understanding what that actually does. To me, "top" implies that you are trying to sort the search results by the frequency of each unique value in one field and displays on the top X most frequently occurring values of that field. When you feed multiple field names to the top command, what results are returned exactly?

[stephanefotso · Accepted solution]

Hello/
The top command Finds the most frequent tuple of values of all fields in the field list, along with a count and percentage. Means search something | top host_ip, username, will find the most frenquent values of the field host_ip , and the most frequent values of the field username

If the optional by-clause is provided, top will find the most frequent values for each distinct tuple of values of the group-by fields. http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Top

Thanks

[jli001]

That's exactly it! To test this answer I have created a lookup file and ran top against different combinations of fields. The top command behaved as stephanefotso described.