Splunk Search

I have a seach command but i need to remove the percent column

pboon
New Member

I have a command that gives me the correct info what i want which is
(eventtype="wineventlog_system") source="inEventLog:" (host="" OR ComputerName="") TaskCategory="" SourceName="" EventCode="*" (Type="Error" OR Type="Warning") * | sort -count | top limit=5 host
this displays a percent column which i want to remove and I have tried to use | top host showperc=f but it doesnt work I have tried to use the showperc=f in many formats and it changes the bar chart wrong and doesnt remove the result column.

Can someone help with the last part to remove the percentage column but still display the right bar chart.

Tags (1)
0 Karma
1 Solution

FrankVl
Ultra Champion

Just add that inside the initial topcommand, don't add an additional top command.

(eventtype="wineventlog_system") source="inEventLog:" (host="*" OR ComputerName="*") TaskCategory="*" SourceName="*" EventCode="*" (Type="Error" OR Type="Warning") | sort -count | top showperc=f limit=10 host

View solution in original post

0 Karma

FrankVl
Ultra Champion

Just add that inside the initial topcommand, don't add an additional top command.

(eventtype="wineventlog_system") source="inEventLog:" (host="*" OR ComputerName="*") TaskCategory="*" SourceName="*" EventCode="*" (Type="Error" OR Type="Warning") | sort -count | top showperc=f limit=10 host

0 Karma

pboon
New Member

your a star!

0 Karma

FrankVl
Ultra Champion

It seems to work fine for me when I add showperc=f to a search like that. Is that bar chart part of a dashboard? Or are you running this as an ad hoc search and then opening the visualization panel?

0 Karma

pboon
New Member

Hi, how are you adding the showperc=f like this?
(eventtype="wineventlog_system") source="inEventLog:" (host="" OR ComputerName="") TaskCategory="" SourceName="" EventCode="*" (Type="Error" OR Type="Warning") * | sort -count | top limit=10 host | top hosts showperc=f

when I add this to my search the bar chart doesn't show the true info afterwards they all display 1 count only.
yes the bar chart is part of the dashboard.

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...