topic Re: Get top 20 countries from Cisco ASA events in Getting Data In https://community.splunk.com/t5/Getting-Data-In/Get-top-20-countries-from-Cisco-ASA-events/m-p/275038#M52757 <P>Try </P> <PRE><CODE>eventtype= | iplocation src_ip | stats count by Country|sort 20 - count </CODE></PRE> Mon, 08 Feb 2016 09:37:06 GMT renjith_nair 2016-02-08T09:37:06Z Get top 20 countries from Cisco ASA events https://community.splunk.com/t5/Getting-Data-In/Get-top-20-countries-from-Cisco-ASA-events/m-p/275036#M52755 <P>Hi,</P> <P>I am searching my Cisco ASA logs to count where an IP originates from by country.</P> <P>It looks like this:</P> <P>eventtype= | iplocation src_ip | stats count by Country </P> <P>It works well to give me a count of all the countries, but I can't get it to give me the top 20 only. I have tried multiple combinations of the 'top' and 'head'</P> <P>I don't want to just choose 20 results per page as I need to generate reports for this.</P> <P>Can anyone help me out?</P> Mon, 08 Feb 2016 09:12:20 GMT https://community.splunk.com/t5/Getting-Data-In/Get-top-20-countries-from-Cisco-ASA-events/m-p/275036#M52755 madstylex 2016-02-08T09:12:20Z Re: Get top 20 countries from Cisco ASA events https://community.splunk.com/t5/Getting-Data-In/Get-top-20-countries-from-Cisco-ASA-events/m-p/275037#M52756 <P>You can try this instead:</P> <PRE><CODE>eventtype= | iplocation src_ip | top limit=20 Country </CODE></PRE> Mon, 08 Feb 2016 09:33:42 GMT https://community.splunk.com/t5/Getting-Data-In/Get-top-20-countries-from-Cisco-ASA-events/m-p/275037#M52756 javiergn 2016-02-08T09:33:42Z Re: Get top 20 countries from Cisco ASA events https://community.splunk.com/t5/Getting-Data-In/Get-top-20-countries-from-Cisco-ASA-events/m-p/275038#M52757 <P>Try </P> <PRE><CODE>eventtype= | iplocation src_ip | stats count by Country|sort 20 - count </CODE></PRE> Mon, 08 Feb 2016 09:37:06 GMT https://community.splunk.com/t5/Getting-Data-In/Get-top-20-countries-from-Cisco-ASA-events/m-p/275038#M52757 renjith_nair 2016-02-08T09:37:06Z Re: Get top 20 countries from Cisco ASA events https://community.splunk.com/t5/Getting-Data-In/Get-top-20-countries-from-Cisco-ASA-events/m-p/275039#M52758 <P>This worked, thanks</P> Mon, 08 Feb 2016 14:54:51 GMT https://community.splunk.com/t5/Getting-Data-In/Get-top-20-countries-from-Cisco-ASA-events/m-p/275039#M52758 madstylex 2016-02-08T14:54:51Z