topic How to do this subsearch? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-do-this-subsearch/m-p/19511#M2965 <P>Hi~there, i have logs containing "requestURL" and its "Category" per event. it's easy to count top 10 requestURL, and it displays the table containing "requestURL","count","percent" fileds. now if i wanna append one column named Category in each top 10 row. how can i do this search? or must use lookup table? thanks for your kind help <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Tue, 31 May 2011 08:26:31 GMT hjwang 2011-05-31T08:26:31Z How to do this subsearch? https://community.splunk.com/t5/Splunk-Search/How-to-do-this-subsearch/m-p/19511#M2965 <P>Hi~there, i have logs containing "requestURL" and its "Category" per event. it's easy to count top 10 requestURL, and it displays the table containing "requestURL","count","percent" fileds. now if i wanna append one column named Category in each top 10 row. how can i do this search? or must use lookup table? thanks for your kind help <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Tue, 31 May 2011 08:26:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-do-this-subsearch/m-p/19511#M2965 hjwang 2011-05-31T08:26:31Z Re: How to do this subsearch? https://community.splunk.com/t5/Splunk-Search/How-to-do-this-subsearch/m-p/19512#M2966 <P>Just add "Category" as a parameter to <CODE>top</CODE>:</P> <PRE><CODE>&lt;yourbasesearch&gt; | top 10 requestURL,Category </CODE></PRE> <P>This gives you the top 10 <EM>pairs</EM> of requestURL and Category, so if one requestURL would have different values for Category these would be split up, but I'm guessing that is not likely to happen in your logs.</P> Tue, 31 May 2011 13:20:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-do-this-subsearch/m-p/19512#M2966 Ayn 2011-05-31T13:20:29Z Re: How to do this subsearch? https://community.splunk.com/t5/Splunk-Search/How-to-do-this-subsearch/m-p/19513#M2967 <P>Thanks,Ayn. i thought top command just use only one field to caculate.i didn't expect it can do such thing.</P> Wed, 01 Jun 2011 03:34:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-do-this-subsearch/m-p/19513#M2967 hjwang 2011-06-01T03:34:22Z