topic Re: How to edit my search to only show top 5 IPs by Office? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-only-show-top-5-IPs-by-Office/m-p/131402#M35845 <P>Top removes City and Open columns. And Top does not use values in Open column.</P> Fri, 06 Feb 2015 10:40:54 GMT rus7am 2015-02-06T10:40:54Z How to edit my search to only show top 5 IPs by Office? https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-only-show-top-5-IPs-by-Office/m-p/131400#M35843 <P>Hello,</P> <P>We have this search below: </P> <PRE><CODE>stats count(eval(State="OPEN")) as "Open", count(eval(State="CLOSED")) as "Closed" by Office, City, IP | sort City, Office, -Open </CODE></PRE> <P>And results in this table:</P> <P>City Office IP Open Closed<BR /> City1 Office1 IP1 30<BR /> City1 Office1 IP2 18<BR /> City1 Office1 IP3 10<BR /> City1 Office1 IP4 5<BR /> City1 Office1 IP5 4<BR /> City1 Office1 IP6 1<BR /> City1 Office1 IP7 1<BR /> City1 Office2 IP1 30<BR /> City1 Office2 IP2 28<BR /> City1 Office2 IP3 20<BR /> City1 Office2 IP4 19<BR /> City1 Office2 IP5 18<BR /> City1 Office2 IP6 17<BR /> City1 Office2 IP7 10<BR /> City1 Office2 IP8 1</P> <P>Is it possible to limit it to display only the top 5 IPs by Office?</P> <P>City Office IP Open Closed<BR /> City1 Office1 IP1 30<BR /> City1 Office1 IP2 18<BR /> City1 Office1 IP3 10<BR /> City1 Office1 IP4 5<BR /> City1 Office1 IP5 4<BR /> City1 Office2 IP1 30<BR /> City1 Office2 IP2 28<BR /> City1 Office2 IP3 20<BR /> City1 Office2 IP4 19<BR /> City1 Office2 IP5 18<BR /> City2 Office1 ...</P> Thu, 05 Feb 2015 16:41:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-only-show-top-5-IPs-by-Office/m-p/131400#M35843 rus7am 2015-02-05T16:41:22Z Re: How to edit my search to only show top 5 IPs by Office? https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-only-show-top-5-IPs-by-Office/m-p/131401#M35844 <P>Use top:</P> <PRE><CODE>... |top limit=5 IP by Office </CODE></PRE> Thu, 05 Feb 2015 17:32:13 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-only-show-top-5-IPs-by-Office/m-p/131401#M35844 jtrucks 2015-02-05T17:32:13Z Re: How to edit my search to only show top 5 IPs by Office? https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-only-show-top-5-IPs-by-Office/m-p/131402#M35845 <P>Top removes City and Open columns. And Top does not use values in Open column.</P> Fri, 06 Feb 2015 10:40:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-only-show-top-5-IPs-by-Office/m-p/131402#M35845 rus7am 2015-02-06T10:40:54Z