When I type this search query in splunk search head:
index=main sourcetype=mySrcType | top fieldA fieldB
Splunk automatically adds count column to the resulting table. Now, what is this count? is it a simple sum of each field count?
When I type this search query in splunk search head:
index=main sourcetype=mySrcType | top fieldA fieldB
Splunk automatically adds count column to the resulting table. Now, what is this count? is it a simple sum of each field count?
The count is showing you the number of times thatt field value pair show up in the time range and query you ran. If you want to exclude it, you can add
| fields - count
Top counts the most common 10 values of each of the fields you list after it's command
You can read more about it on its documentation page http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Top