https://community.splunk.com/t5/Splunk-Search/How-to-control-the-number-of-top-results-shown-from-a-search-in/m-p/166406#M47383 <P>I am trying to control how many of the top results are shown.</P> <P>I have the following search</P> <P><CODE>stats max(c1693801001) as MaxCPU by measObjLdn | sort - MaxCPU</CODE></P> <P>which gives me the following in the stats view:</P> <PRE><CODE>measObjLdn MaxCPU Object1 13 Object2 11 Object3 8 Object4 7 Object5 4 Object6 4 Object7 3 Object8 3 </CODE></PRE> <P>How do i just show the top 3 that would look like </P> <PRE><CODE>measObjLdn MaxCPU Object1 13 Object2 11 Object3 8 </CODE></PRE> <P>I have tried top but no joy, it just keeps showing them all <BR /> <CODE>....| top limit=5 showcount=f showperc=f MaxCPU by measObjLdn | sort - MaxCPU</CODE></P> Mon, 09 Mar 2015 03:45:46 GMT HattrickNZ 2015-03-09T03:45:46Z https://community.splunk.com/t5/Splunk-Search/How-to-control-the-number-of-top-results-shown-from-a-search-in/m-p/166406#M47383 <P>I am trying to control how many of the top results are shown.</P> <P>I have the following search</P> <P><CODE>stats max(c1693801001) as MaxCPU by measObjLdn | sort - MaxCPU</CODE></P> <P>which gives me the following in the stats view:</P> <PRE><CODE>measObjLdn MaxCPU Object1 13 Object2 11 Object3 8 Object4 7 Object5 4 Object6 4 Object7 3 Object8 3 </CODE></PRE> <P>How do i just show the top 3 that would look like </P> <PRE><CODE>measObjLdn MaxCPU Object1 13 Object2 11 Object3 8 </CODE></PRE> <P>I have tried top but no joy, it just keeps showing them all <BR /> <CODE>....| top limit=5 showcount=f showperc=f MaxCPU by measObjLdn | sort - MaxCPU</CODE></P> Mon, 09 Mar 2015 03:45:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-control-the-number-of-top-results-shown-from-a-search-in/m-p/166406#M47383 HattrickNZ 2015-03-09T03:45:46Z https://community.splunk.com/t5/Splunk-Search/How-to-control-the-number-of-top-results-shown-from-a-search-in/m-p/166407#M47384 <P>Just change to:</P> <P><CODE>stats max(c1693801001) as MaxCPU by measObjLdn | sort 3 - MaxCPU</CODE></P> Mon, 09 Mar 2015 04:21:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-control-the-number-of-top-results-shown-from-a-search-in/m-p/166407#M47384 musskopf 2015-03-09T04:21:22Z https://community.splunk.com/t5/Splunk-Search/How-to-control-the-number-of-top-results-shown-from-a-search-in/m-p/166408#M47385 <P>That is because you have a by clause so it is showing you the top 5 MaxCPU for each measObjLdn. You should be using <CODE>head 3</CODE> after sorting to find out the top 3 values regardless of the combination.</P> Mon, 09 Mar 2015 04:24:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-control-the-number-of-top-results-shown-from-a-search-in/m-p/166408#M47385 ramdaspr 2015-03-09T04:24:18Z https://community.splunk.com/t5/Splunk-Search/How-to-control-the-number-of-top-results-shown-from-a-search-in/m-p/166409#M47386 <P>++ simpler solution.</P> <P>When i read the docs, it says "Specify the number of results to sort. " so I assumed only the first 3 events would be used but it should says "Specify the number of sorted results to return" instead.</P> Mon, 09 Mar 2015 04:36:43 GMT https://community.splunk.com/t5/Splunk-Search/How-to-control-the-number-of-top-results-shown-from-a-search-in/m-p/166409#M47386 ramdaspr 2015-03-09T04:36:43Z https://community.splunk.com/t5/Splunk-Search/How-to-control-the-number-of-top-results-shown-from-a-search-in/m-p/166410#M47387 <P>tks all, the one below by ramdaspr works also.</P> Tue, 10 Mar 2015 19:37:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-control-the-number-of-top-results-shown-from-a-search-in/m-p/166410#M47387 HattrickNZ 2015-03-10T19:37:18Z