https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-find-the-top-10-results-based-on-a/m-p/186466#M53688 <P>I think I found a solution to the problem. </P> <P><EM>...| streamstats count by USER |table ID,CALCULATED_NUM,USER,count| sort by USER,-CALCULATED_NUM| where count&lt;=10</EM></P> <P>Please let me know if there is straightforward way of doing this.</P> Mon, 28 Sep 2020 18:42:06 GMT nibinabr 2020-09-28T18:42:06Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-find-the-top-10-results-based-on-a/m-p/186464#M53686 <P>Hi Splunkers,</P> <P>I had a question </P> <PRE><CODE>ID N1 N2 USER CALCULATED_NUM 001 10 2 user_1 8 002 8 4 user_2 4 003 7 9 user_1 -2 . . </CODE></PRE> <P>CALCULATED_NUM=N1-N2</P> <P>I need to write a search query that returns the top 10 CALCULATED_NUM by each USER.</P> <PRE><CODE>....| table ID,CALCULATED_NUM,USER| sort by USER,-CALCULATED_NUM </CODE></PRE> <P>gives me all the ID's sorted by user with CALCULATED_NUM sorted in desc order, but I need only the top 10 IDs per USER.</P> <P>Thanks</P> Mon, 19 Jan 2015 15:38:48 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-find-the-top-10-results-based-on-a/m-p/186464#M53686 nibinabr 2015-01-19T15:38:48Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-find-the-top-10-results-based-on-a/m-p/186465#M53687 <P>Hi nibinabr,</P> <P>Look at this answer <A href="http://answers.splunk.com/answers/208658/how-to-limit-results-with-multiple-group-by-condit.html#answer-209608">http://answers.splunk.com/answers/208658/how-to-limit-results-with-multiple-group-by-condit.html#answer-209608</A> to get an example how this can be done. </P> <P>cheers, MuS</P> Mon, 19 Jan 2015 17:07:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-find-the-top-10-results-based-on-a/m-p/186465#M53687 MuS 2015-01-19T17:07:03Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-find-the-top-10-results-based-on-a/m-p/186466#M53688 <P>I think I found a solution to the problem. </P> <P><EM>...| streamstats count by USER |table ID,CALCULATED_NUM,USER,count| sort by USER,-CALCULATED_NUM| where count&lt;=10</EM></P> <P>Please let me know if there is straightforward way of doing this.</P> Mon, 28 Sep 2020 18:42:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-find-the-top-10-results-based-on-a/m-p/186466#M53688 nibinabr 2020-09-28T18:42:06Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-find-the-top-10-results-based-on-a/m-p/186467#M53689 <P>Thanks MuS, </P> <P>I found a similar post that helped me get into the solution.</P> <P><A href="http://answers.splunk.com/answers/148651/how-to-get-top-2-mb-users-per-website.html">http://answers.splunk.com/answers/148651/how-to-get-top-2-mb-users-per-website.html</A></P> Mon, 19 Jan 2015 17:10:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-find-the-top-10-results-based-on-a/m-p/186467#M53689 nibinabr 2015-01-19T17:10:58Z