Splunk Search

how to make use of two top options .....

dilstn
Explorer

I have a log which displays a others(section) while use the top command with limit.....

here is my search command.... ........| top limit=0 Customer,Price

This gives me a other() section in pie chart ....

so i used another top option such as

like this ..... ...........| top limit=0 useother=true Customer,Price

The above top command is not working only the " limit "option is working ..... but not the " useother=true " option is not working .... can u please guide me...........

but when i use ......| top useother=true Customer,Price ..... this alone works ......

but i need top command with two option to work .... how can i make this ..please guide me....

Tags (1)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

The settings limit=0 useother=true contradict each other. useother applies to those cut off by the limit, but limit=0 doesn't cut anything off.

What you're seeing in the pie chart is the chart summarizing many small slices into one other-slice, that's not a result of the top command. See the tabular results view for confirmation.

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...