https://community.splunk.com/t5/Security/Top-10-Failed-Login/m-p/178577#M5303 <P>You already did the sort -Count, so just complete your search with a <CODE>| head 10</CODE></P> Fri, 13 Dec 2013 19:41:54 GMT dmaislin_splunk 2013-12-13T19:41:54Z https://community.splunk.com/t5/Security/Top-10-Failed-Login/m-p/178576#M5302 <P>Hi<BR /> I would like to find my Top 10 Failed login when I run this search. What should I add to get the right result? Here is the query I have to far. (this search gives me all the Failed Login, I just need to know how to search for Top command)</P> <P>eventtype=msad-failed-user-logons | fields src_host,src_ip,src_nt_domain,user | eval src_ip=replace(src_ip,"::ffff:","") | <CODE>ip-to-host</CODE> | stats values(src_nt_domain) AS "Domain(s)", count AS Count, values(src_host) AS "Host(s)", values(src_ip) AS "IP(s)", sparkline AS "Failure activity" by user | sort -Count | rename user as "Username"</P> Mon, 28 Sep 2020 15:29:02 GMT https://community.splunk.com/t5/Security/Top-10-Failed-Login/m-p/178576#M5302 nebyouadane 2020-09-28T15:29:02Z https://community.splunk.com/t5/Security/Top-10-Failed-Login/m-p/178577#M5303 <P>You already did the sort -Count, so just complete your search with a <CODE>| head 10</CODE></P> Fri, 13 Dec 2013 19:41:54 GMT https://community.splunk.com/t5/Security/Top-10-Failed-Login/m-p/178577#M5303 dmaislin_splunk 2013-12-13T19:41:54Z