https://community.splunk.com/t5/Splunk-Search/How-to-sum-top30-and-then-sum-top31-100-and-then-sum-top101-500/m-p/36706#M8160 <P>Something like this should do it:</P> <PRE><CODE>* | top limit=100 foo | eval a=1 | accum a | rangemap field=a 1-30=1-30 31-100=31-100 101-500=101-500 501-3000=501-3000 default=large | stats sum(count) by range </CODE></PRE> Wed, 29 Jun 2011 15:22:40 GMT vbumgarner 2011-06-29T15:22:40Z https://community.splunk.com/t5/Splunk-Search/How-to-sum-top30-and-then-sum-top31-100-and-then-sum-top101-500/m-p/36705#M8159 <P>I have use sort event from big to small ,now i want to sum 1-30,31-100,101-500,501-3000,3000- .how to do it ? thanks in advance.</P> Wed, 29 Jun 2011 15:05:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sum-top30-and-then-sum-top31-100-and-then-sum-top101-500/m-p/36705#M8159 lihongyan_84 2011-06-29T15:05:10Z https://community.splunk.com/t5/Splunk-Search/How-to-sum-top30-and-then-sum-top31-100-and-then-sum-top101-500/m-p/36706#M8160 <P>Something like this should do it:</P> <PRE><CODE>* | top limit=100 foo | eval a=1 | accum a | rangemap field=a 1-30=1-30 31-100=31-100 101-500=101-500 501-3000=501-3000 default=large | stats sum(count) by range </CODE></PRE> Wed, 29 Jun 2011 15:22:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sum-top30-and-then-sum-top31-100-and-then-sum-top101-500/m-p/36706#M8160 vbumgarner 2011-06-29T15:22:40Z https://community.splunk.com/t5/Splunk-Search/How-to-sum-top30-and-then-sum-top31-100-and-then-sum-top101-500/m-p/36707#M8161 <P>Thanks ，vbumgarner！</P> Thu, 30 Jun 2011 04:15:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sum-top30-and-then-sum-top31-100-and-then-sum-top101-500/m-p/36707#M8161 lihongyan_84 2011-06-30T04:15:25Z