Splunk Search

Display only the top 5 values in count column

sphiwee
Contributor

sphiwee_1-1599604516265.png

Id like to be able to display only the top Total values, struggling with this

Labels (3)
Tags (1)
0 Karma
1 Solution

anthonymelita
Contributor

just adding "| head 5" will keep the top five values of whatever column the results are sorted on. In his screenshot that appears to be host. 
To keep the top 5 Total do, "|sort - Total |head 5"

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

|  head 5

anthonymelita
Contributor

just adding "| head 5" will keep the top five values of whatever column the results are sorted on. In his screenshot that appears to be host. 
To keep the top 5 Total do, "|sort - Total |head 5"

sphiwee
Contributor

Is it possible to hide the total column?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| fields - Total
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...