https://community.splunk.com/t5/Splunk-Search/How-to-get-top-10-values-in-splunk-search/m-p/110109#M28765 <PRE><CODE>source="F:Splunk_Log Files*" status ="Allow" src_ip | stats sum(recv_bytes) as Bytes by src_ip | top limit=10 Bytes </CODE></PRE> Wed, 08 Jul 2015 13:11:30 GMT richgalloway 2015-07-08T13:11:30Z https://community.splunk.com/t5/Splunk-Search/How-to-get-top-10-values-in-splunk-search/m-p/110107#M28763 <P>Hi,<BR /> I want to get top 10 src_ip . I have selected descending order for recv_bytes column .<BR /> Please help me.<BR /> Query as follows <BR /> <STRONG>source="F:\Splunk_Log Files\*" status ="Allow" src_ip | stats sum(recv_bytes) by src_ip</STRONG> . <BR /> <IMG src="https://community.splunk.com/storage/temp/44146-err2.png" alt="alt text" /></P> Tue, 29 Sep 2020 06:37:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-top-10-values-in-splunk-search/m-p/110107#M28763 kavyaa 2020-09-29T06:37:39Z https://community.splunk.com/t5/Splunk-Search/How-to-get-top-10-values-in-splunk-search/m-p/110108#M28764 <P>Are you looking for this?</P> <PRE><CODE>source="F:Splunk_Log Files*" status ="Allow" src_ip | stats sum(recv_bytes) as sum_recv_bytes by src_ip | sort - sum_recv_bytes | head 10 </CODE></PRE> Wed, 08 Jul 2015 13:08:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-top-10-values-in-splunk-search/m-p/110108#M28764 martin_mueller 2015-07-08T13:08:33Z https://community.splunk.com/t5/Splunk-Search/How-to-get-top-10-values-in-splunk-search/m-p/110109#M28765 <PRE><CODE>source="F:Splunk_Log Files*" status ="Allow" src_ip | stats sum(recv_bytes) as Bytes by src_ip | top limit=10 Bytes </CODE></PRE> Wed, 08 Jul 2015 13:11:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-top-10-values-in-splunk-search/m-p/110109#M28765 richgalloway 2015-07-08T13:11:30Z