https://community.splunk.com/t5/Splunk-Search/Sort-and-display-top-5-values-alone/m-p/164348#M46690 <P>Worked... Thanks...</P> Thu, 23 Apr 2015 18:04:24 GMT sushmitha_mj 2015-04-23T18:04:24Z https://community.splunk.com/t5/Splunk-Search/Sort-and-display-top-5-values-alone/m-p/164346#M46688 <P>I am trying to display the top 5 memory used values by command - Meaning the top 5 commands with maximum usage, but I seem to be unable to get the output. Here is my search:</P> <PRE><CODE>index=os sourcetype=ps host=xyz | eval RSZ_MB=RSZ_KB/1024| stats max(RSZ_MB) as "Memory_Used" by COMMAND | sort -Memory_Used | top 5 </CODE></PRE> <P>Thanks,<BR /> Sushmitha</P> Thu, 23 Apr 2015 17:02:30 GMT https://community.splunk.com/t5/Splunk-Search/Sort-and-display-top-5-values-alone/m-p/164346#M46688 sushmitha_mj 2015-04-23T17:02:30Z https://community.splunk.com/t5/Splunk-Search/Sort-and-display-top-5-values-alone/m-p/164347#M46689 <P>hi try this:</P> <PRE><CODE>index=os sourcetype=ps host=xyz | eval RSZ_MB=RSZ_KB/1024| stats max(RSZ_MB) as "Memory_Used" by COMMAND | sort -Memory_Used | top limit=5 Memory_Used </CODE></PRE> Thu, 23 Apr 2015 17:06:15 GMT https://community.splunk.com/t5/Splunk-Search/Sort-and-display-top-5-values-alone/m-p/164347#M46689 NOUMSSI 2015-04-23T17:06:15Z https://community.splunk.com/t5/Splunk-Search/Sort-and-display-top-5-values-alone/m-p/164348#M46690 <P>Worked... Thanks...</P> Thu, 23 Apr 2015 18:04:24 GMT https://community.splunk.com/t5/Splunk-Search/Sort-and-display-top-5-values-alone/m-p/164348#M46690 sushmitha_mj 2015-04-23T18:04:24Z https://community.splunk.com/t5/Splunk-Search/Sort-and-display-top-5-values-alone/m-p/164349#M46691 <P>Excellent! Please <STRONG>vote</STRONG> if the answer was helpful.</P> Thu, 23 Apr 2015 21:53:57 GMT https://community.splunk.com/t5/Splunk-Search/Sort-and-display-top-5-values-alone/m-p/164349#M46691 NOUMSSI 2015-04-23T21:53:57Z