topic Re: How to get the sourcetype count by each source top 10 events counts in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-get-the-sourcetype-count-by-each-source-top-10-events/m-p/654307#M226091 <P>Thank you so much!!!</P> Mon, 14 Aug 2023 19:55:34 GMT harishsplunk7 2023-08-14T19:55:34Z How to get the sourcetype count by each source top 10 events counts https://community.splunk.com/t5/Splunk-Search/How-to-get-the-sourcetype-count-by-each-source-top-10-events/m-p/654078#M226016 <P>I need to get the&nbsp; sourcetype count by each source top 10 events counts in splunk</P><P>Example :&nbsp;</P><P>I have 3 sourcetype and sending data from different sources,&nbsp;</P><P>sourcetype A - a,b,c,d,e</P><P>sourcetype B -a,b,c,d,e</P><P>sourcetype C -a,b,c,d,e</P><P>Now, I need to display top 10 event count by each source by sourcetype</P> Fri, 11 Aug 2023 13:13:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-sourcetype-count-by-each-source-top-10-events/m-p/654078#M226016 harishsplunk7 2023-08-11T13:13:00Z Re: How to get the sourcetype count by each source top 10 events counts https://community.splunk.com/t5/Splunk-Search/How-to-get-the-sourcetype-count-by-each-source-top-10-events/m-p/654134#M226027 <P>Can you elaborate what you are looking for? &nbsp;Maybe illustrate what the end result looks like, and explain what each box means.</P> Fri, 11 Aug 2023 23:49:08 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-sourcetype-count-by-each-source-top-10-events/m-p/654134#M226027 yuanliu 2023-08-11T23:49:08Z Re: How to get the sourcetype count by each source top 10 events counts https://community.splunk.com/t5/Splunk-Search/How-to-get-the-sourcetype-count-by-each-source-top-10-events/m-p/654148#M226037 <LI-CODE lang="markup">| stats count by sourcetype source | sort 0 sourcetype -count | streamstats count as rank by sourcetype | where rank &lt;= 10</LI-CODE> Sat, 12 Aug 2023 07:11:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-sourcetype-count-by-each-source-top-10-events/m-p/654148#M226037 ITWhisperer 2023-08-12T07:11:30Z Re: How to get the sourcetype count by each source top 10 events counts https://community.splunk.com/t5/Splunk-Search/How-to-get-the-sourcetype-count-by-each-source-top-10-events/m-p/654307#M226091 <P>Thank you so much!!!</P> Mon, 14 Aug 2023 19:55:34 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-sourcetype-count-by-each-source-top-10-events/m-p/654307#M226091 harishsplunk7 2023-08-14T19:55:34Z