https://community.splunk.com/t5/Splunk-Search/Help-with-search-to-show-the-top-5-results/m-p/352419#M104313 <P>This should do it.</P> <PRE><CODE>index="all_eqt" Plant=15 ProcessCode=T DefectCode="*" MachineNumber&lt;26 | stats sum(TotalSquareYards) as "Total Square Yards" by StyleName | top 5 "Total Square Yards" by StyleName | sort StyleName </CODE></PRE> Wed, 20 Sep 2017 21:03:22 GMT richgalloway 2017-09-20T21:03:22Z https://community.splunk.com/t5/Splunk-Search/Help-with-search-to-show-the-top-5-results/m-p/352418#M104312 <PRE><CODE>index="all_eqt" Plant=15 ProcessCode=T DefectCode="*" MachineNumber&lt;26 | stats sum(TotalSquareYards) as "Total Square Yards" by StyleName | sortStyleName </CODE></PRE> <P>I'm trying to limit the data shown on the chart to the top 5 styles with the highest TotalSquareYards</P> Wed, 20 Sep 2017 20:18:45 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-search-to-show-the-top-5-results/m-p/352418#M104312 Hppjet 2017-09-20T20:18:45Z https://community.splunk.com/t5/Splunk-Search/Help-with-search-to-show-the-top-5-results/m-p/352419#M104313 <P>This should do it.</P> <PRE><CODE>index="all_eqt" Plant=15 ProcessCode=T DefectCode="*" MachineNumber&lt;26 | stats sum(TotalSquareYards) as "Total Square Yards" by StyleName | top 5 "Total Square Yards" by StyleName | sort StyleName </CODE></PRE> Wed, 20 Sep 2017 21:03:22 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-search-to-show-the-top-5-results/m-p/352419#M104313 richgalloway 2017-09-20T21:03:22Z https://community.splunk.com/t5/Splunk-Search/Help-with-search-to-show-the-top-5-results/m-p/352420#M104314 <P><CODE>| top</CODE> is problematic here. it's really designed only to count the occurrences of the field values and give the values themselves. The <CODE>by StyleName</CODE> will give you the <CODE>top 5</CODE> of each Stylename, which won't help, since only one record exists for each StyleName, it's not limiting anything.</P> <P>Two options...</P> <PRE><CODE>| sort - "Total Square Yards" | head 5 </CODE></PRE> <P>...or more succinctly...</P> <PRE><CODE>| sort 5 - "Total Square Yards" </CODE></PRE> Wed, 20 Sep 2017 21:17:59 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-search-to-show-the-top-5-results/m-p/352420#M104314 DalJeanis 2017-09-20T21:17:59Z