The following query
index=test | top Hostname
produces a chart that has percentages included in the chart along with the top hostnames. How do I not include the percentages in the chart? I do not want percentages in the chart.
The showperc modifier to the top command is what you want. Here is how you use it:
index=test | top showperc=false Hostname
The showperc modifier to the top command is what you want. Here is how you use it:
index=test | top showperc=false Hostname
You can do:
index=test
| stats count(_raw) as topHostnames by Hostname
| sort - topHostnames