Splunk Search

Why is the top command not separating out top values for each numerical data field?

lagoon7mac
New Member

I have numerical data into 5 different fields that occurs daily and indexed into splunk. I am trying to see what the top values per field and chart that before I perform other stats commands. So if i perform sourcetype=numdata NOT "TEXTDATA" | top limit=10 field1", I get the top values of the field. When I add "top field1, field2, field3" then I get all of the top values for the fields combined. I would like to get the top values per field? Does anyone know how to SPL this?

Tags (4)
0 Karma
1 Solution

sdaniels
Splunk Employee
Splunk Employee

You might be able to use the append command depending on the type of data and if the values make sense to be charted together.

sourcetype=numdata NOT "TEXTDATA" | top 10 field1 | append [ sourcetype=numdata NOT "TEXTDATA" | top 10 field2 ]  etc.....

View solution in original post

0 Karma

lagoon7mac
New Member

That works with the addition of the search command at the begining of the search bracket so [ sourcetype=numdata... ] becomes [ search sourcetype=numdata ....]

0 Karma

sdaniels
Splunk Employee
Splunk Employee

You might be able to use the append command depending on the type of data and if the values make sense to be charted together.

sourcetype=numdata NOT "TEXTDATA" | top 10 field1 | append [ sourcetype=numdata NOT "TEXTDATA" | top 10 field2 ]  etc.....
0 Karma
Get Updates on the Splunk Community!

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Combine Multiline Logs into a Single Event with SOCK: a Step-by-Step Guide for ...

Combine multiline logs into a single event with SOCK - a step-by-step guide for newbies Olga Malita The ...

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...