topic How to get the top 3 counts for each index? in Splunk Search

How to get the top 3 counts for each index?

lys1030 — Mon, 13 Jul 2015 22:07:37 GMT

Let me make an example to clarify:

Now I have the search result like this:

How can I get the top 3 counts of each index?
In the end, I want to get search result like this:

Hope this is clear. Thanks in advance!

woodcock — Mon, 13 Jul 2015 22:10:46 GMT

You need the top command, like this:

... | top limit=3 count BY index

Or, to keep the country field, this:

... | sort 0 - count | streamstats current=t count AS rank by index | where rank<4 | sort 0 index count

lys1030 — Mon, 13 Jul 2015 22:13:47 GMT

Thanks, the second one works!

woodcock — Mon, 13 Jul 2015 22:16:28 GMT

Which one?

lys1030 — Mon, 13 Jul 2015 22:33:08 GMT

Thanks! the second one works perfectly!