What does splunk count when more than one field is used in the 'top' command? -


when type search query in splunk search head:

index=main sourcetype=mysrctype | top fielda fieldb 

splunk automatically adds count column resulting table. now, count? simple sum of each field count?

the count showing number of times thatt field value pair show in time range , query ran. if want exclude it, can add

| fields - count


Comments

Popular posts from this blog

service - Android MediaPlayer calls onCompletion before it already finished -

javascript - Training Neural Network to play flappy bird with genetic algorithm - Why can't it learn? -

javascript - Create a stacked percentage column -