https://community.splunk.com/t5/Getting-Data-In/Need-help-to-filter-the-top-five-sources/m-p/62797#M12563 <P>it doesn't display any results.</P> Thu, 13 Dec 2012 23:03:20 GMT mike7860 2012-12-13T23:03:20Z https://community.splunk.com/t5/Getting-Data-In/Need-help-to-filter-the-top-five-sources/m-p/62795#M12561 <P>I need to find the top five sources. As Splunk displays as a default the top ten commonly used or found values. I need to narrow it down to find the top 5 source files. I have tried using the following search criteria but nothing displays:<BR /> index=summary_volume report=volume_source | eval _time=info_max_time | timechart span=1m latest(VOL_MB) by series | top limit=5 source</P> Mon, 28 Sep 2020 12:57:51 GMT https://community.splunk.com/t5/Getting-Data-In/Need-help-to-filter-the-top-five-sources/m-p/62795#M12561 mike7860 2020-09-28T12:57:51Z https://community.splunk.com/t5/Getting-Data-In/Need-help-to-filter-the-top-five-sources/m-p/62796#M12562 <P>How do you define "top 5"? Is it the five sources with the greatest total volume over the whole time period? If so, this should do it:</P> <PRE><CODE>index=summary_volume report=volume_source | eval _time=info_max_time | timechart span=1m limit=5 latest(VOL_MB) by series </CODE></PRE> <P>Although I do wonder about what is in your "summary_volume" index. If you inserted data into the summary index using an <CODE>sitimechart</CODE> command, then there should be a field called <CODE>search_name</CODE>, not <CODE>report</CODE>. And you should also not need to do an <CODE>eval</CODE> to create the _time field.</P> Mon, 28 Sep 2020 12:57:53 GMT https://community.splunk.com/t5/Getting-Data-In/Need-help-to-filter-the-top-five-sources/m-p/62796#M12562 lguinn2 2020-09-28T12:57:53Z https://community.splunk.com/t5/Getting-Data-In/Need-help-to-filter-the-top-five-sources/m-p/62797#M12563 <P>it doesn't display any results.</P> Thu, 13 Dec 2012 23:03:20 GMT https://community.splunk.com/t5/Getting-Data-In/Need-help-to-filter-the-top-five-sources/m-p/62797#M12563 mike7860 2012-12-13T23:03:20Z