When using the top command in the following search, which of the following will be true about the results?
index="main" sourcetype="access_*" action="purchase" | top 3 statusCode by user showperc=f countfield=status_code_count

Question

When using the top command in the following search, which of the following will be true about the results?

index="main" sourcetype="access_*" action="purchase" | top 3 statusCode by user showperc=f countfield=status_code_count

bryan calderon · Accepted Answer

The top three most common values in statusCode will be displayed for each user.

bryan calderon · Answer

The search will fail. The proper top command format is top limit=3 instead of top 3.

bryan calderon · Answer

Only the top three overall most common values in statusCode will be displayed.

bryan calderon · Answer

The percentage field will be displayed in the results.

List of questions