https://community.splunk.com/t5/Splunk-Search/Display-top-3-Employees-by-Class-Frequency/m-p/28062#M5507 <P>| top limit=3 Class_Frequency by Employee_ID showcount=f showperc=f</P> Mon, 28 Sep 2020 18:22:43 GMT jfreund 2020-09-28T18:22:43Z https://community.splunk.com/t5/Splunk-Search/Display-top-3-Employees-by-Class-Frequency/m-p/28059#M5504 <P>I have 2 fields in CSV that I want to only display the top 3 employees by the Class frequency. I know the Top command will suffice, but not sure of the syntax.</P> <P>Here is a sampling of data:<BR /> Employee_ID Class_Frequency<BR /> tsmith 2388<BR /> mjones 81<BR /> smurphy 6591<BR /> tpayne 1309<BR /> jjones 109</P> Mon, 28 Sep 2020 12:12:43 GMT https://community.splunk.com/t5/Splunk-Search/Display-top-3-Employees-by-Class-Frequency/m-p/28059#M5504 efelder0 2020-09-28T12:12:43Z https://community.splunk.com/t5/Splunk-Search/Display-top-3-Employees-by-Class-Frequency/m-p/28060#M5505 <PRE><CODE> * | chart count(Employee_ID) as count by Class_Frequency | sort - count | head 3 or * | stats count(Employee_ID) by Class_Frequency | sort - count | head 3 </CODE></PRE> Tue, 07 Aug 2012 15:58:59 GMT https://community.splunk.com/t5/Splunk-Search/Display-top-3-Employees-by-Class-Frequency/m-p/28060#M5505 dmaislin_splunk 2012-08-07T15:58:59Z https://community.splunk.com/t5/Splunk-Search/Display-top-3-Employees-by-Class-Frequency/m-p/28061#M5506 <P>sort - Classification_Frequency | head 3 worked..</P> Tue, 07 Aug 2012 17:44:45 GMT https://community.splunk.com/t5/Splunk-Search/Display-top-3-Employees-by-Class-Frequency/m-p/28061#M5506 efelder0 2012-08-07T17:44:45Z https://community.splunk.com/t5/Splunk-Search/Display-top-3-Employees-by-Class-Frequency/m-p/28062#M5507 <P>| top limit=3 Class_Frequency by Employee_ID showcount=f showperc=f</P> Mon, 28 Sep 2020 18:22:43 GMT https://community.splunk.com/t5/Splunk-Search/Display-top-3-Employees-by-Class-Frequency/m-p/28062#M5507 jfreund 2020-09-28T18:22:43Z