https://community.splunk.com/t5/Splunk-Search/Top-to-a-sum-by-a-field/m-p/128067#M34762 <P>Try adding following to your already existing search</P> <PRE><CODE>|eval CountF=1|streamstats sum(CountF) as CountF by BRAND | where CountF &lt;11 </CODE></PRE> Tue, 05 Nov 2013 16:41:26 GMT somesoni2 2013-11-05T16:41:26Z https://community.splunk.com/t5/Splunk-Search/Top-to-a-sum-by-a-field/m-p/128063#M34758 <P>I am trying to get top 10 channels (chanName) by brand (BRAND) based on the duration (durationPerRoom). I have durationPerRoom sorted descending, and if I could head 10 by brand, that would be great. I have tried to do a top function, but it just counts the channels, or counts the durations, etc. Any ideas?</P> <P>| stats sum(OF_ROOMS__C) as numberOfRooms,sum(sumDuration) as sumDuration by chanName BRAND|eval durationPerRoom=sumDuration/numberOfRooms| sort by durationPerRoom desc</P> Mon, 28 Sep 2020 15:11:57 GMT https://community.splunk.com/t5/Splunk-Search/Top-to-a-sum-by-a-field/m-p/128063#M34758 cmerriman 2020-09-28T15:11:57Z https://community.splunk.com/t5/Splunk-Search/Top-to-a-sum-by-a-field/m-p/128064#M34759 <P>Try adding following to your already existing search</P> <P>|eval CountF=1|streamstats sum(CountF) as CountF by BRAND | | where CountF &lt;11</P> Mon, 04 Nov 2013 21:07:46 GMT https://community.splunk.com/t5/Splunk-Search/Top-to-a-sum-by-a-field/m-p/128064#M34759 somesoni2 2013-11-04T21:07:46Z https://community.splunk.com/t5/Splunk-Search/Top-to-a-sum-by-a-field/m-p/128065#M34760 <P>That worked PERFECTLY! Thank you!!!</P> Tue, 05 Nov 2013 16:14:58 GMT https://community.splunk.com/t5/Splunk-Search/Top-to-a-sum-by-a-field/m-p/128065#M34760 cmerriman 2013-11-05T16:14:58Z https://community.splunk.com/t5/Splunk-Search/Top-to-a-sum-by-a-field/m-p/128066#M34761 <P>Added my comment as answer, so that you can close the question.</P> Tue, 05 Nov 2013 16:41:06 GMT https://community.splunk.com/t5/Splunk-Search/Top-to-a-sum-by-a-field/m-p/128066#M34761 somesoni2 2013-11-05T16:41:06Z https://community.splunk.com/t5/Splunk-Search/Top-to-a-sum-by-a-field/m-p/128067#M34762 <P>Try adding following to your already existing search</P> <PRE><CODE>|eval CountF=1|streamstats sum(CountF) as CountF by BRAND | where CountF &lt;11 </CODE></PRE> Tue, 05 Nov 2013 16:41:26 GMT https://community.splunk.com/t5/Splunk-Search/Top-to-a-sum-by-a-field/m-p/128067#M34762 somesoni2 2013-11-05T16:41:26Z