https://community.splunk.com/t5/Splunk-Search/how-to-find-most-popular-field-over-time/m-p/446843#M170568 <P>Hi @tariqazeem123<BR /> You would like to use the top command for this - </P> <PRE><CODE>index=main sourcetype=app| top limit=0 program_name </CODE></PRE> <P>Let me know if there is more to your query. Thanks</P> Tue, 02 Jul 2019 06:30:12 GMT amitm05 2019-07-02T06:30:12Z https://community.splunk.com/t5/Splunk-Search/how-to-find-most-popular-field-over-time/m-p/446842#M170567 <P>i have data in default index "main" and has sourcetype "app" and field like program_name.</P> <P>i want to find most popular programmes over time. can anybody please help me with this ?</P> Tue, 02 Jul 2019 04:24:56 GMT https://community.splunk.com/t5/Splunk-Search/how-to-find-most-popular-field-over-time/m-p/446842#M170567 tariqazeem123 2019-07-02T04:24:56Z https://community.splunk.com/t5/Splunk-Search/how-to-find-most-popular-field-over-time/m-p/446843#M170568 <P>Hi @tariqazeem123<BR /> You would like to use the top command for this - </P> <PRE><CODE>index=main sourcetype=app| top limit=0 program_name </CODE></PRE> <P>Let me know if there is more to your query. Thanks</P> Tue, 02 Jul 2019 06:30:12 GMT https://community.splunk.com/t5/Splunk-Search/how-to-find-most-popular-field-over-time/m-p/446843#M170568 amitm05 2019-07-02T06:30:12Z https://community.splunk.com/t5/Splunk-Search/how-to-find-most-popular-field-over-time/m-p/446844#M170569 <P>Hi @tariqazeem123 ,</P> <P>There are 2 ways:<BR /> 1. You can run your command and use sort command<BR /> index=main sourcetype=app | sort program_name by _time</P> <P>2.You can use top command and you can limit it to no. of events you want<BR /><BR /> index=main sourcetype=app | top limit=0 program_name</P> Tue, 02 Jul 2019 08:26:30 GMT https://community.splunk.com/t5/Splunk-Search/how-to-find-most-popular-field-over-time/m-p/446844#M170569 snigdhasaxena 2019-07-02T08:26:30Z