splunksplunk-querysplunk-calculation

What does splunk count when more than one field is used in the 'top' command?


When I type this search query in splunk search head:

index=main sourcetype=mySrcType | top fieldA fieldB

Splunk automatically adds count column to the resulting table. Now, what is this count? is it a simple sum of each field count?


Solution

  • The count is showing you the number of times thatt field value pair show up in the time range and query you ran. If you want to exclude it, you can add

    | fields - count