Implementing Splunk 7, Third Edition - Third Edition

Controlling the output of top

The default behavior for top is to show the 10 largest counts. The possible row count is the product of all fields specified, in this case, date_month and date_wday. Using our data in this example, there are eight possible combinations. If you would like to see less than ten rows (or, in our example, less than eight), add the argument limit, like so:

sourcetype=tm1* error | top limit=4 date_month date_wday

Arguments change the behavior of a command; they take the form of name=value. Many commands require the arguments to immediately follow the command name, so it's a good idea to always follow this structure.

Each command has different arguments, as appropriate. As you type in the search bar, a drop-down help ...