https://community.splunk.com/t5/Splunk-Search/How-to-filter-top-3-counts-over-each-group/m-p/168731#M48124 <P>Thanks, jeffland. It works! <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P>Do you have any idea if I want to search with data model? (|tstats command)<BR /> Seem I can only use raw search now.</P> Thu, 13 Aug 2015 03:19:16 GMT amylala 2015-08-13T03:19:16Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-top-3-counts-over-each-group/m-p/168727#M48120 <P>Here is data I get after count by Message and Error Code.</P> <P>Message ErrorCode Count<BR /> Msg1 1000 500<BR /> Msg1 1001 400<BR /> Msg1 1002 300<BR /> Msg1 1003 200<BR /> Msg1 1004 100<BR /> Msg2 2000 550<BR /> Msg2 2001 450<BR /> Msg2 2002 350<BR /> Msg2 2003 250<BR /> Msg2 2004 150</P> <P>I want top 3 count of each Msg. How can I get result as below?<BR /> Message ErrorCode Count<BR /> Msg1 1000 500<BR /> Msg1 1001 400<BR /> Msg1 1002 300<BR /> Msg2 2000 550<BR /> Msg2 2001 450<BR /> Msg2 2002 350</P> Wed, 12 Aug 2015 07:52:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-top-3-counts-over-each-group/m-p/168727#M48120 amylala 2015-08-12T07:52:16Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-top-3-counts-over-each-group/m-p/168728#M48121 <P>Does this do the trick?</P> <PRE><CODE>... | top limit=3 showperc=f ErrorCode by Message </CODE></PRE> <P>Do it instead of <CODE>stats count by Message ErrorCode</CODE>.</P> Wed, 12 Aug 2015 10:34:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-top-3-counts-over-each-group/m-p/168728#M48121 jeffland 2015-08-12T10:34:21Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-top-3-counts-over-each-group/m-p/168729#M48122 <P>Try something like this</P> <PRE><CODE>Your current search giving Count by Message and ErrorCode | sort 0 Message -Count | streamstats count as rank by Message | where rank&lt;=3 | fields - rank </CODE></PRE> Wed, 12 Aug 2015 15:58:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-top-3-counts-over-each-group/m-p/168729#M48122 somesoni2 2015-08-12T15:58:09Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-top-3-counts-over-each-group/m-p/168730#M48123 <P>... | sort Message -count | dedup 3 Message</P> Wed, 12 Aug 2015 16:03:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-top-3-counts-over-each-group/m-p/168730#M48123 pradeepkumarg 2015-08-12T16:03:09Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-top-3-counts-over-each-group/m-p/168731#M48124 <P>Thanks, jeffland. It works! <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P>Do you have any idea if I want to search with data model? (|tstats command)<BR /> Seem I can only use raw search now.</P> Thu, 13 Aug 2015 03:19:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-top-3-counts-over-each-group/m-p/168731#M48124 amylala 2015-08-13T03:19:16Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-top-3-counts-over-each-group/m-p/168732#M48125 <P>Thanks, somesoni2. <BR /> This is really what I want. <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Thu, 13 Aug 2015 03:30:38 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-top-3-counts-over-each-group/m-p/168732#M48125 amylala 2015-08-13T03:30:38Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-top-3-counts-over-each-group/m-p/168733#M48126 <P>Thanks, gpradeepkumarreddy. <BR /> This method is more simple. But It is sort by count after dedup.<BR /> I need to sort again at the end. </P> Thu, 13 Aug 2015 03:47:02 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-top-3-counts-over-each-group/m-p/168733#M48126 amylala 2015-08-13T03:47:02Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-top-3-counts-over-each-group/m-p/168734#M48127 <P>Sorry, I don't know why you wouldn't be able to use this with a data model. I must admit though that I don't work with data models a lot.</P> Thu, 13 Aug 2015 05:31:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-top-3-counts-over-each-group/m-p/168734#M48127 jeffland 2015-08-13T05:31:36Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-top-3-counts-over-each-group/m-p/168735#M48128 <P>Sorry, my mistake, no need to sorting is not changed after dedup</P> Thu, 13 Aug 2015 06:19:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-top-3-counts-over-each-group/m-p/168735#M48128 amylala 2015-08-13T06:19:51Z