https://community.splunk.com/t5/Splunk-Search/How-to-get-top-10-values-of-a-column-and-its-raw-data-for-each/m-p/445177#M171573 <P>index=omi_Uat host=DEFRNCMP* sourcetype=all_events_attributes | eval {idx} = elt | fields ID,UMN,TicketID,node | top limit=10 UMN</P> <P>This is the query I'm trying to get top 10 UMN . How can I get field values of ID,TicketID,node for each UMN</P> Wed, 30 Sep 2020 00:24:22 GMT anz999 2020-09-30T00:24:22Z https://community.splunk.com/t5/Splunk-Search/How-to-get-top-10-values-of-a-column-and-its-raw-data-for-each/m-p/445177#M171573 <P>index=omi_Uat host=DEFRNCMP* sourcetype=all_events_attributes | eval {idx} = elt | fields ID,UMN,TicketID,node | top limit=10 UMN</P> <P>This is the query I'm trying to get top 10 UMN . How can I get field values of ID,TicketID,node for each UMN</P> Wed, 30 Sep 2020 00:24:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-top-10-values-of-a-column-and-its-raw-data-for-each/m-p/445177#M171573 anz999 2020-09-30T00:24:22Z https://community.splunk.com/t5/Splunk-Search/How-to-get-top-10-values-of-a-column-and-its-raw-data-for-each/m-p/445178#M171574 <P>I think you can do a join and then search again.</P> <P>index=omi_Uat host=DEFRNCMP* sourcetype=all_events_attributes | eval {idx} = elt | fields ID,UMN,TicketID,node | top limit=10 UMN<BR /> | join UMN<BR /> [search index=omi_Uat host=DEFRNCMP* sourcetype=all_events_attributes | eval {idx} = elt | fields ID,UMN,TicketID,node]<BR /> | fields UMN ID TicketID node</P> Wed, 30 Sep 2020 00:24:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-top-10-values-of-a-column-and-its-raw-data-for-each/m-p/445178#M171574 jodyfsu 2020-09-30T00:24:32Z https://community.splunk.com/t5/Splunk-Search/How-to-get-top-10-values-of-a-column-and-its-raw-data-for-each/m-p/445179#M171575 <P>You can manually perform the top command after a stats that pulls the latest _raw event using the below query:</P> <PRE><CODE>index=omi_Uat host=DEFRNCMP* sourcetype=all_events_attributes | eval {idx} = elt | fields ID,UMN,TicketID,node | stats count values(ID) as ID values(TicketID) as TicketID values(node) as node by UMN | eventstats sum(count) as TotalCount | eval percent=round((count/TotalCount)*100,6) | sort 0 - count | streamstats count as counter | where counter&lt;=10 | fields - TotalCount counter </CODE></PRE> <P>If you require an other field that will make it a bit tricker, but it is possible:</P> <PRE><CODE>index=omi_Uat host=DEFRNCMP* sourcetype=all_events_attributes | eval {idx} = elt | fields ID,UMN,TicketID,node | stats count values(ID) as ID values(TicketID) as TicketID values(node) as node by UMN | eventstats sum(count) as TotalCount | eval percent=round((count/TotalCount)*100,6) | sort 0 - count | streamstats count as counter | eval UMN=if(counter&gt;10, UMN, "Other") | fields - TotalCount counter | stats sum(count) as count sum(percent) as percent values(ID) as ID values(TicketID) as TicketID values(node) as node by UMN | sort 0 - count </CODE></PRE> Thu, 02 May 2019 13:24:48 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-top-10-values-of-a-column-and-its-raw-data-for-each/m-p/445179#M171575 dmarling 2019-05-02T13:24:48Z https://community.splunk.com/t5/Splunk-Search/How-to-get-top-10-values-of-a-column-and-its-raw-data-for-each/m-p/445180#M171576 <P>Sorry, I misread the initial request and the first result was providing _raw values but you wanted specific fields. I have just adjusted it for that.</P> Thu, 02 May 2019 13:30:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-top-10-values-of-a-column-and-its-raw-data-for-each/m-p/445180#M171576 dmarling 2019-05-02T13:30:58Z https://community.splunk.com/t5/Splunk-Search/How-to-get-top-10-values-of-a-column-and-its-raw-data-for-each/m-p/445181#M171577 <P>Thanks . It worked <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Thu, 02 May 2019 14:12:48 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-top-10-values-of-a-column-and-its-raw-data-for-each/m-p/445181#M171577 anz999 2019-05-02T14:12:48Z https://community.splunk.com/t5/Splunk-Search/How-to-get-top-10-values-of-a-column-and-its-raw-data-for-each/m-p/445182#M171578 <P>Thanks for your help.</P> Thu, 02 May 2019 14:13:08 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-top-10-values-of-a-column-and-its-raw-data-for-each/m-p/445182#M171578 anz999 2019-05-02T14:13:08Z https://community.splunk.com/t5/Splunk-Search/How-to-get-top-10-values-of-a-column-and-its-raw-data-for-each/m-p/445183#M171579 <P>Glad I could help!</P> Thu, 02 May 2019 14:14:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-top-10-values-of-a-column-and-its-raw-data-for-each/m-p/445183#M171579 dmarling 2019-05-02T14:14:39Z