https://community.splunk.com/t5/Splunk-Search/How-to-search-for-top-10-with-stats-list-and-count/m-p/223865#M65926 <P>I have the following search that looks for a count of blocked domains per IP:</P> <PRE><CODE>index=indexname |stats count by domain,src_ip |sort -count |stats list(domain) as Domain, list(count) as count by src_ip </CODE></PRE> <P>How would I limit the results to the top 10 IPs and still retain the count of blocked domains per IP? I've tried limit and head commands, but it nullifies the count of blocked domains per IP format.</P> <P>Thx</P> Wed, 27 Apr 2016 15:47:31 GMT jwalzerpitt 2016-04-27T15:47:31Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-top-10-with-stats-list-and-count/m-p/223865#M65926 <P>I have the following search that looks for a count of blocked domains per IP:</P> <PRE><CODE>index=indexname |stats count by domain,src_ip |sort -count |stats list(domain) as Domain, list(count) as count by src_ip </CODE></PRE> <P>How would I limit the results to the top 10 IPs and still retain the count of blocked domains per IP? I've tried limit and head commands, but it nullifies the count of blocked domains per IP format.</P> <P>Thx</P> Wed, 27 Apr 2016 15:47:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-top-10-with-stats-list-and-count/m-p/223865#M65926 jwalzerpitt 2016-04-27T15:47:31Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-top-10-with-stats-list-and-count/m-p/223866#M65927 <P>Hello</P> <P>Have you tried something like:</P> <PRE><CODE>| top 10 src_ip </CODE></PRE> <P>For example:</P> <PRE><CODE>index=indexname |stats count by domain,src_ip |sort -count |stats list(domain) as Domain, list(count) as count by src_ip | top 10 src_ip </CODE></PRE> Wed, 27 Apr 2016 16:59:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-top-10-with-stats-list-and-count/m-p/223866#M65927 tkwaller 2016-04-27T16:59:30Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-top-10-with-stats-list-and-count/m-p/223867#M65928 <P>I have, but the count for the top 10 hosts all equal 1.</P> <P>Doing |top 10 Domain by src_ip provides the same output of the count equaling 1.</P> <P>Thx</P> Wed, 27 Apr 2016 17:02:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-top-10-with-stats-list-and-count/m-p/223867#M65928 jwalzerpitt 2016-04-27T17:02:45Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-top-10-with-stats-list-and-count/m-p/223868#M65929 <P>Try like this</P> <PRE><CODE>index=indexname |stats count by domain,src_ip |sort -count | streamstats count as rank by src_ip | where rank&lt;=10 |stats list(domain) as Domain, list(count) as count by src_ip </CODE></PRE> <P><STRONG>Update</STRONG> </P> <P>If you're looking for top 10 src_ip, then try this</P> <PRE><CODE>index=indexname | stats count by domain,src_ip |sort -count |stats list(domain) as Domain, list(count) as count sum(count) as total by src_ip | sort -total | head 10 </CODE></PRE> Wed, 27 Apr 2016 17:54:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-top-10-with-stats-list-and-count/m-p/223868#M65929 somesoni2 2016-04-27T17:54:07Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-top-10-with-stats-list-and-count/m-p/223869#M65930 <P>Thx for the modified search - retains the format of count of blocked domains per IP, but getting the full list of source IPs (src_ip) and not just the top 10.</P> Wed, 27 Apr 2016 18:08:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-top-10-with-stats-list-and-count/m-p/223869#M65930 jwalzerpitt 2016-04-27T18:08:10Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-top-10-with-stats-list-and-count/m-p/223870#M65931 <P>I think I figured it out after some fiddling. My query now looks like this:</P> <P>index=indexname<BR /> |stats count by domain,src_ip<BR /> |sort -count <BR /> |stats list(domain) as Domain, list(count) as count, sum(count) as total by src_ip<BR /> |sort -total | head 10<BR /> |fields - total</P> <P>which retains the format of the count by domain per source IP and only shows the top 10</P> Tue, 29 Sep 2020 09:34:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-top-10-with-stats-list-and-count/m-p/223870#M65931 jwalzerpitt 2020-09-29T09:34:19Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-top-10-with-stats-list-and-count/m-p/223871#M65932 <P>Thanks for this, if i want to see top 10 and all others in others? what will be the search? Can you please help?</P> Thu, 30 May 2019 05:29:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-top-10-with-stats-list-and-count/m-p/223871#M65932 ahmadsaadwarrai 2019-05-30T05:29:00Z