6.1 The top Command

6.1 The top Command

Quick Answer: | top <field> finds the most common values of a field (default 10). Splunk adds count and percent columns. Use limit= to change how many values appear and BY to compute top values per group.

Domain 5.0 Using Basic Transforming Commands is about 15% of the Splunk Core Certified User exam. Topic 5.1 The top command is the first transforming tool you must master: convert matching events into a small ranked table of frequent values. Later topics in this domain—rare and stats—reuse the same idea that transforming commands replace the Events list with a Statistics table.

Why this matters on the exam

Many User scenarios ask: “Which search shows the most common status codes?” or “What does top return by default?” If you answer with sort on _raw, or expect raw events after | top status, you lose easy points. top is purpose-built for frequency ranking, not chronological ordering and not arbitrary numeric aggregation.

What transforming means here

A transforming command takes the events that survive earlier pipeline stages and aggregates them into a new result set. After | top, you typically look at the Statistics tab. The Visualization tab can chart those stats later (Domain 6), but Domain 5 tests the command behavior, not chart builders.

Core syntax

Official shape (User-level essentials):

... | top [<options>] <field-list> [BY <field-list>]

Minimal example:

index=web sourcetype=access_combined
| top status

Typical options you should recognize:

You can pass multiple fields (comma-separated in the field list) so top ranks combinations—for example most common (method, status) pairs—not each field separately.

index=web
| top limit=5 method, status

Reading count and percent

For each returned value (or value tuple):

• count — how many events in the incoming result set had that value combination
• percent — that count as a percentage of the incoming events top evaluated

Exam trap: percent is relative to the events that reached top, not necessarily “percent of all data in the index forever.” Earlier filters (status=5*, a host constraint, a short time range) shrink the denominator.

index=web status=404
| top limit=3 uri_path

Here counts and percents describe only 404 events in the selected time range—not all HTTP traffic.

The BY clause

BY (or by) computes top values inside each group:

index=web
| top limit=3 status BY host

Each host gets its own top-3 status values with counts/percents scoped to that host’s events. Without BY, you get one global ranking across all events that reached the command.

Worked scenario

You investigate noisy web traffic. Goal: five most common client IPs hitting a site in the last 24 hours, with counts.

index=web earliest=-24h
| top limit=5 clientip

Expected Statistics columns: clientip, count, percent. If the question asks for “least common,” that is rare, not top. If it asks for average bytes per host, that is stats, not top.

Common traps (memorize these)

1. top ≠ sort. sort - count after some other command is different from asking Splunk for the most frequent field values. top counts and ranks in one step and is the User-exam answer for “most common.”
2. Default limit is 10. A question that says “top ten” may omit limit= because ten is already the default; “top 20” needs limit=20.
3. Transforming ends the event stream. After top, you no longer browse the original Events list for those raw rows—the job’s primary table is statistical.
4. Fields must exist. If clientip is not extracted for the events you searched, top clientip cannot invent values. Use the fields sidebar / interesting fields workflow from Domain 3 before aggregating.
5. useother is off by default. Truncating to limit=5 does not automatically show an OTHER bucket unless you enable it.
6. Do not confuse with chart/timechart. Those are related reporting/visualization commands you meet when building charts; Domain 5.1 tests top itself.

Choosing top vs nearby commands

Practice mental checklist

Before you pick an answer that includes | top:

• Is the goal most common values of a named field?
• Do you need a non-default limit?
• Do you need results per group (BY)?
• Are count/percent expected (default) or suppressed (showcount=false / showperc=false)?

Master those four decisions and Domain 5.1 questions become mechanical.