0

When I type this search query in splunk search head:

index=main sourcetype=mySrcType | top fieldA fieldB

Splunk automatically adds count column to the resulting table. Now, what is this count? is it a simple sum of each field count?

Ahmed Hussein
  • 715
  • 1
  • 15
  • 38

2 Answers2

1

The count is showing you the number of times thatt field value pair show up in the time range and query you ran. If you want to exclude it, you can add

| fields - count

skoelpin
  • 212
  • 1
  • 5
0

Top counts the most common 10 values of each of the fields you list after it's command

You can read more about it on its documentation page http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Top

Joao Figueiredo
  • 3,120
  • 3
  • 31
  • 40