Splunk Search

Append Columns to Top Output

samhodgson
Path Finder

Hi,

I have the following search and I would like to enumerate a total event count prior to the Top function and then append it to the results:

`nagios_index` `nagios_core_sourcetype` host_name="*" ((eventname="SERVICE ALERT" NOT status_code="OK") OR 
(eventname="HOST ALERT" NOT status_code="UP")) 
| eval name=if(eventname=="HOST ALERT","Host",service) 
| top eventname,host_name,name limit="100"

The macro's at the start just specify the index and sourcetype. From what I can tell there is no way to append columns to Top's output? Any help on the best way to achieve the desired output would be greatly appreciated!

Cheers

Tags (1)
0 Karma
1 Solution

tiagofbmm
Influencer

Hey

Can you use eventstats before doing the count?

 `nagios_index` `nagios_core_sourcetype` host_name="*" ((eventname="SERVICE ALERT" NOT status_code="OK") OR 
 (eventname="HOST ALERT" NOT status_code="UP")) 
 | eval name=if(eventname=="HOST ALERT","Host",service) 
 | eventstats count(whatever_you_want_to_count) as CountField
 | top eventname,host_name,name,CountField limit="100"

View solution in original post

tiagofbmm
Influencer

Hey

Can you use eventstats before doing the count?

 `nagios_index` `nagios_core_sourcetype` host_name="*" ((eventname="SERVICE ALERT" NOT status_code="OK") OR 
 (eventname="HOST ALERT" NOT status_code="UP")) 
 | eval name=if(eventname=="HOST ALERT","Host",service) 
 | eventstats count(whatever_you_want_to_count) as CountField
 | top eventname,host_name,name,CountField limit="100"
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...