https://community.splunk.com/t5/Splunk-Search/How-to-show-the-top-command-with-distinct-value/m-p/428825#M172550 <P>Give this a try</P> <PRE><CODE>index=proxy | stats dc(user) as UniqUsers count by dest_host | sort 5 -count </CODE></PRE> Tue, 12 Mar 2019 13:57:36 GMT somesoni2 2019-03-12T13:57:36Z https://community.splunk.com/t5/Splunk-Search/How-to-show-the-top-command-with-distinct-value/m-p/428824#M172549 <P>I've got proxy logs and I want to show the top 5 urls and for that the count of distinct users who tried to access it.<BR /> I tried the following search command </P> <BLOCKQUOTE> <P>index=proxy <BR /> | eval dc_user=[search* stats dc(user) by url| return $dc_user] <BR /> | top dest_host limit=5 <BR /> | table dest_host dc_user</P> </BLOCKQUOTE> <P>How can I get this work? <BR /> I also wanted to add the count of the url and the percentage. </P> <P>Thank you in advance.</P> Tue, 29 Sep 2020 23:36:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-show-the-top-command-with-distinct-value/m-p/428824#M172549 igschloessl 2020-09-29T23:36:56Z https://community.splunk.com/t5/Splunk-Search/How-to-show-the-top-command-with-distinct-value/m-p/428825#M172550 <P>Give this a try</P> <PRE><CODE>index=proxy | stats dc(user) as UniqUsers count by dest_host | sort 5 -count </CODE></PRE> Tue, 12 Mar 2019 13:57:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-show-the-top-command-with-distinct-value/m-p/428825#M172550 somesoni2 2019-03-12T13:57:36Z https://community.splunk.com/t5/Splunk-Search/How-to-show-the-top-command-with-distinct-value/m-p/428826#M172551 <P>Does this do what you need?</P> <PRE><CODE>index=proxy | eventstats dc(user) as unique_users by url | top url | sort 5 - count | table url, unique_users, count, percent </CODE></PRE> Wed, 13 Mar 2019 15:40:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-show-the-top-command-with-distinct-value/m-p/428826#M172551 cpmoone 2019-03-13T15:40:58Z