https://community.splunk.com/t5/Splunk-Search/Top-N-results-in-table/m-p/256233#M176418 <P>Give this a try</P> <PRE><CODE>your current search giving Machine, ErrorType ,ErrorCount | sort 0 Machine,-num(ErrorCount) | dedup Machine </CODE></PRE> Mon, 17 Oct 2016 16:39:06 GMT somesoni2 2016-10-17T16:39:06Z https://community.splunk.com/t5/Splunk-Search/Top-N-results-in-table/m-p/256232#M176417 <P>The intermediate result of a query is</P> <P>Machine | ErrorType |ErrorCount<BR /> A | ErrorA | 4<BR /> A | ErrorB | 3<BR /> B | ErrorC | 6<BR /> B | ErrorD | 3<BR /> C | ErrorE | 3<BR /> C | ErrorF | 9</P> <P>I want to show the top 1 result(in terms of Error count) per machine. The result should be like</P> <P>Machine | ErrorType |ErrorCount<BR /> A | ErrorA | 4<BR /> A | ErrorC | 6<BR /> B | ErrorF | 9</P> <P>I tried using "top 1 ErrorCount by Machine" but it is trimming other useful fields like ErrorType.<BR /> How do I achieve this?</P> Mon, 17 Oct 2016 14:20:47 GMT https://community.splunk.com/t5/Splunk-Search/Top-N-results-in-table/m-p/256232#M176417 ponsakthi 2016-10-17T14:20:47Z https://community.splunk.com/t5/Splunk-Search/Top-N-results-in-table/m-p/256233#M176418 <P>Give this a try</P> <PRE><CODE>your current search giving Machine, ErrorType ,ErrorCount | sort 0 Machine,-num(ErrorCount) | dedup Machine </CODE></PRE> Mon, 17 Oct 2016 16:39:06 GMT https://community.splunk.com/t5/Splunk-Search/Top-N-results-in-table/m-p/256233#M176418 somesoni2 2016-10-17T16:39:06Z