6.1 The top Command

Splunk Core Certified User Study Guide Exam

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

1.1 Current Exam Facts & Logistics 1.2 Study Strategy & Learning Path

2 Splunk Basics

2.1 Splunk Components 2.2 Uses of Splunk 2.3 Splunk Apps 2.4 User Settings & Basic Navigation

3 Basic Searching

3.1 Running Basic Searches 3.2 Setting Time Ranges 3.3 Contents of Search Results 3.4 Refining Searches 3.5 Using the Timeline 3.6 Working with Events 3.7 Controlling Search Jobs 3.8 Saving Search Results

4 Using Fields in Searches

4.1 Understanding Fields 4.2 Using Fields in Searches 4.3 The Fields Sidebar

5 Search Language Fundamentals

5.1 Basic Search Commands & Practices 5.2 The Search Pipeline 5.3 Specifying Indexes in Searches 5.4 table, rename, fields, dedup, and sort

6 Using Basic Transforming Commands

6.1 The top Command 6.2 The rare Command 6.3 The stats Command

7 Creating Reports and Dashboards

7.1 Saving and Editing Reports 7.2 Statistical Table Reports 7.3 Chart Visualization Reports 7.4 Creating Dashboards and Adding Reports 7.5 Editing Dashboards

8 Creating and Using Lookups

8.1 Lookup Concepts and File Examples 8.2 Creating Lookup Files and Definitions 8.3 Configuring Automatic Lookups 8.4 Using Lookups in Searches

9 Creating Scheduled Reports and Alerts

9.1 Scheduled Reports 9.2 Describing and Creating Alerts 9.3 Viewing Fired Alerts

6.1 The top Command

Key Takeaways Explain This Topic AI

The top command is a transforming command that returns the most common values of one or more fields, with default fields count and percent.

Default limit is 10; use limit=N to change how many value tuples appear (limit=0 returns all up to the configured maximum).

A BY clause groups top results so each group gets its own most-common values.

top ends the event list and produces a Statistics-tab table—do not confuse it with sort on raw events.

showcount, showperc, countfield, and percentfield control whether and how count/percent appear.

Last updated: August 2026

6.1 The top Command

Quick Answer: | top <field> finds the most common values of a field (default 10 ). Splunk adds count and percent columns. Use limit= to change how many values appear and BY to compute top values per group .

Domain 5.0 Using Basic Transforming Commands is about 15% of the Splunk Core Certified User exam. Topic 5.1 The top command is the first transforming tool you must master: convert matching events into a small ranked table of frequent values. Later topics in this domain— rare and stats —reuse the same idea that transforming commands replace the Events list with a Statistics table.

Why this matters on the exam

Many User scenarios ask: “Which search shows the most common status codes?” or “What does top return by default?” If you answer with sort on _raw , or expect raw events after | top status , you lose easy points. top is purpose-built for frequency ranking , not chronological ordering and not arbitrary numeric aggregation.

What transforming means here

A transforming command takes the events that survive earlier pipeline stages and aggregates them into a new result set. After | top , you typically look at the Statistics tab. The Visualization tab can chart those stats later (Domain 6), but Domain 5 tests the command behavior , not chart builders.

Idea What it means for top
Input Events (or prior results) that still contain the field(s) you name
Output Ranked table of most common value combinations
Default extras Fields named count and percent
Default row count limit=10 most common tuples
Core syntax
Official shape (User-level essentials): ... | top [<options>] <field-list> [BY <field-list>]
Minimal example: index=web sourcetype=access_combined
| top status

Typical options you should recognize:

Option Role Default / note
limit=<int> How many top tuples to return 10 ; limit=0 returns all up to the command maximum
showcount=<bool> Include the count column true
showperc=<bool> Include the percent column true
countfield=<string> Rename the count column default name count
percentfield=<string> Rename the percent column default name percent
useother=<bool> Add a rollup row for values beyond the limit false
otherstr=<string> Label for that rollup row when useother is true commonly OTHER

You can pass multiple fields (comma-separated in the field list) so top ranks combinations —for example most common (method, status) pairs—not each field separately. index=web

| top limit=5 method, status
Reading count and percent

For each returned value (or value tuple):

count — how many events in the incoming result set had that value combination
percent — that count as a percentage of the incoming events top evaluated

Exam trap: percent is relative to the events that reached top , not necessarily “percent of all data in the index forever.” Earlier filters ( status=5* , a host constraint, a short time range) shrink the denominator. index=web status=404

| top limit=3 uri_path

Here counts and percents describe only 404 events in the selected time range—not all HTTP traffic.

The BY clause
BY (or by ) computes top values inside each group : index=web
| top limit=3 status BY host

Each host gets its own top-3 status values with counts/percents scoped to that host’s events. Without BY , you get one global ranking across all events that reached the command.

Pattern Result shape (conceptually)
| top status Global most common statuses
| top status BY host Per-host most common statuses
| top limit=20 user Twenty most active/common users (by event frequency)
Worked scenario

You investigate noisy web traffic. Goal: five most common client IPs hitting a site in the last 24 hours, with counts. index=web earliest=-24h

| top limit=5 clientip

Expected Statistics columns: clientip , count , percent . If the question asks for “least common,” that is rare , not top . If it asks for average bytes per host, that is stats , not top .

Common traps (memorize these)

top ≠ sort . sort - count after some other command is different from asking Splunk for the most frequent field values. top counts and ranks in one step and is the User-exam answer for “most common.”

Default limit is 10. A question that says “top ten” may omit limit= because ten is already the default; “top 20” needs limit=20 .

Transforming ends the event stream. After top , you no longer browse the original Events list for those raw rows—the job’s primary table is statistical.

Fields must exist. If clientip is not extracted for the events you searched, top clientip cannot invent values. Use the fields sidebar / interesting fields workflow from Domain 3 before aggregating.

useother is off by default. Truncating to limit=5 does not automatically show an OTHER bucket unless you enable it.

Do not confuse with chart/timechart. Those are related reporting/visualization commands you meet when building charts; Domain 5.1 tests top itself.

Choosing top vs nearby commands

Need Prefer
Most frequent values + percent top
Least frequent values + percent rare
Sum, avg, distinct count, custom aggs stats
Order existing rows by a field sort (non-transforming ordering; covered in SPL fundamentals)
Practice mental checklist

Before you pick an answer that includes | top :

Is the goal most common values of a named field?

Do you need a non-default limit ?

Do you need results per group ( BY )?

Are count/percent expected (default) or suppressed ( showcount=false / showperc=false )?

Master those four decisions and Domain 5.1 questions become mechanical.