https://community.splunk.com/t5/Splunk-Search/top-command-with-values/m-p/46979#M11208 <P>I want top 10 values for a field based on the timer control.</P> <P>mysearch | top 10 E_Time</P> <P>above command return top 10 results based on the events count. is there anyway to return top 10 values and display a graph based on these values? </P> <P>alternatively I can run this search and display the graph</P> <P>mysearch | table _time E_TIME | sort -E_TIME | head 10 | where len(E_TIME) &gt; 0 </P> Mon, 28 Sep 2020 12:52:33 GMT jangid 2020-09-28T12:52:33Z https://community.splunk.com/t5/Splunk-Search/top-command-with-values/m-p/46979#M11208 <P>I want top 10 values for a field based on the timer control.</P> <P>mysearch | top 10 E_Time</P> <P>above command return top 10 results based on the events count. is there anyway to return top 10 values and display a graph based on these values? </P> <P>alternatively I can run this search and display the graph</P> <P>mysearch | table _time E_TIME | sort -E_TIME | head 10 | where len(E_TIME) &gt; 0 </P> Mon, 28 Sep 2020 12:52:33 GMT https://community.splunk.com/t5/Splunk-Search/top-command-with-values/m-p/46979#M11208 jangid 2020-09-28T12:52:33Z https://community.splunk.com/t5/Splunk-Search/top-command-with-values/m-p/46980#M11209 <P>Use <CODE>head</CODE>:</P> <PRE><CODE>... | head 10 </CODE></PRE> <P>EDIT: <CODE>head</CODE> will not necessarily return the latest results. The <CODE>head</CODE> command will retrieve the first X items from what it's given in the search pipeline. If it's run directly after the initial <CODE>search</CODE> command, then you are right, what comes in the search pipeline will be the latest events. If you run it after <CODE>table</CODE> though, for instance, it will get the table items and give you the first X of those. So, if you have a table with data that is sorted in the way you want, running <CODE>head 10</CODE> will give you the first 10 items according to that sort order. I believe that's what you wanted.</P> Wed, 28 Nov 2012 11:45:10 GMT https://community.splunk.com/t5/Splunk-Search/top-command-with-values/m-p/46980#M11209 Ayn 2012-11-28T11:45:10Z https://community.splunk.com/t5/Splunk-Search/top-command-with-values/m-p/46981#M11210 <P>this will return latest result. I want top 10 values from a particular field.</P> Wed, 28 Nov 2012 15:19:00 GMT https://community.splunk.com/t5/Splunk-Search/top-command-with-values/m-p/46981#M11210 jangid 2012-11-28T15:19:00Z https://community.splunk.com/t5/Splunk-Search/top-command-with-values/m-p/46982#M11211 <P>No. Updated my answer, please read.</P> Wed, 28 Nov 2012 15:54:34 GMT https://community.splunk.com/t5/Splunk-Search/top-command-with-values/m-p/46982#M11211 Ayn 2012-11-28T15:54:34Z https://community.splunk.com/t5/Splunk-Search/top-command-with-values/m-p/46983#M11212 <P>Thanks Ayn, yep you are right I used | head x to get the result. I solved my problem with table | sort | head <BR /> buy my question, is it possible to get top 10 E_Time values [not events] using top command?</P> Thu, 29 Nov 2012 10:50:03 GMT https://community.splunk.com/t5/Splunk-Search/top-command-with-values/m-p/46983#M11212 jangid 2012-11-29T10:50:03Z https://community.splunk.com/t5/Splunk-Search/top-command-with-values/m-p/46984#M11213 <P>Nope, <CODE>top</CODE> works with item counts exclusively, so you cannot use it to work with values.</P> Thu, 29 Nov 2012 12:11:30 GMT https://community.splunk.com/t5/Splunk-Search/top-command-with-values/m-p/46984#M11213 Ayn 2012-11-29T12:11:30Z