https://community.splunk.com/t5/Splunk-Search/Top-10-values-from-10-different-columns/m-p/36338#M8086 <P>If you basically have one row and loads of columns you can transpose the result and then work with one column.</P> Tue, 19 Feb 2013 11:29:46 GMT martin_mueller 2013-02-19T11:29:46Z https://community.splunk.com/t5/Splunk-Search/Top-10-values-from-10-different-columns/m-p/36337#M8085 <P>I want top 10 values from the below query:<BR /> Problem is , we have applied stats average on multiple column, so simply writing top 10 or head 10 won't work in this case. Sorting is also an issue in this case.</P> <P>...<BR /> |stats avg(http_data) as "HTTP",avg(https_data) as "HTTPS",avg(rtsp_data) as "RTSP",avg(rtp_data) as "RTP",avg(wtp_data) as "WTP",avg(wsp_data) as "WSP",avg(mms_data) as "MMS",avg(sip_data) as "SIP",avg(ftp_data) as "FTP",avg(dns_data) as "DNS Lookups",avg(smtp_data) as "SMTP",avg(pop3_data) as "POP3",avg(imap_data) as "IMAP",avg(skype_data) as "SKYPE",avg(torrent_data) as "TORRENT",avg(msn_data) as "MSN",avg(yahoo_data) as "YAHOO",avg(ddlink_data) as "DDLINK" ,avg(jabber_data) as "JABBER",avg(ppstream_data) as "PPSTREAM",avg(steam_data) as "STEAM",avg(imesh_data) as "IMESH",avg(hamachivpn_data) as "HAMACHIVPN",avg(mute_data) as "MUTE",avg(pando_data) as "PANDO",avg(orb_data) as "ORB",avg(winny_data) as "WINNY",avg(slingbox_data) as "SLINGEBOX",avg(fasttrack_data) as "FASTTRACK" </P> Mon, 28 Sep 2020 13:20:40 GMT https://community.splunk.com/t5/Splunk-Search/Top-10-values-from-10-different-columns/m-p/36337#M8085 Aakanksha 2020-09-28T13:20:40Z https://community.splunk.com/t5/Splunk-Search/Top-10-values-from-10-different-columns/m-p/36338#M8086 <P>If you basically have one row and loads of columns you can transpose the result and then work with one column.</P> Tue, 19 Feb 2013 11:29:46 GMT https://community.splunk.com/t5/Splunk-Search/Top-10-values-from-10-different-columns/m-p/36338#M8086 martin_mueller 2013-02-19T11:29:46Z https://community.splunk.com/t5/Splunk-Search/Top-10-values-from-10-different-columns/m-p/36339#M8087 <P>No, this will not work.Transpose will categorize all values in one column but still TOP or SORT command won't work here, as there will be no column name and data is different.</P> Tue, 19 Feb 2013 11:47:39 GMT https://community.splunk.com/t5/Splunk-Search/Top-10-values-from-10-different-columns/m-p/36339#M8087 Aakanksha 2013-02-19T11:47:39Z https://community.splunk.com/t5/Splunk-Search/Top-10-values-from-10-different-columns/m-p/36340#M8088 <P>Sort and head work perfectly, consider this as an example:</P> <PRE><CODE>| gentimes start=-1 increment=5m | stats avg(starttime) as avg1 avg(endtime) as avg2 max(starttime) as max1 max(endtime) as max2 min(starttime) as min1 min(endtime) as min2 | transpose | sort - "row 1" | head 3 </CODE></PRE> Tue, 19 Feb 2013 11:52:34 GMT https://community.splunk.com/t5/Splunk-Search/Top-10-values-from-10-different-columns/m-p/36340#M8088 martin_mueller 2013-02-19T11:52:34Z