https://community.splunk.com/t5/Splunk-Search/Top-Values-of-2-fields/m-p/41476#M9612 <P>Ron, </P> <P>I used your example but it seems that Splunk can only handle 6 digits precision using the top search command.</P> Wed, 07 Mar 2012 16:03:23 GMT lpolo 2012-03-07T16:03:23Z https://community.splunk.com/t5/Splunk-Search/Top-Values-of-2-fields/m-p/41472#M9608 <P>Hi, I'm trying to create a search that would show the following data</P> <P>Top unique field1 Top field2</P> <P>E.g. (Username and command)</P> <P>Get top unique Usernames and the corresponding top "command" executed by that "Username"</P> <P>Username Command</P> <P>user1 write</P> <P>Hope someone can help, thanks.</P> Wed, 09 Feb 2011 11:55:28 GMT https://community.splunk.com/t5/Splunk-Search/Top-Values-of-2-fields/m-p/41472#M9608 mcm10285 2011-02-09T11:55:28Z https://community.splunk.com/t5/Splunk-Search/Top-Values-of-2-fields/m-p/41473#M9609 <P>It sounds like you want a list of the top command performed by each user. This will work:</P> <PRE><CODE>... | top limit=1 command by user </CODE></PRE> <P>Also, if you only wanted the top 10 users responsible for the top commands, do it like this:</P> <PRE><CODE>... | top limit=1 command by user | head 10 </CODE></PRE> Wed, 09 Feb 2011 12:57:29 GMT https://community.splunk.com/t5/Splunk-Search/Top-Values-of-2-fields/m-p/41473#M9609 Ron_Naken 2011-02-09T12:57:29Z https://community.splunk.com/t5/Splunk-Search/Top-Values-of-2-fields/m-p/41474#M9610 <P>You can change the "limit" option to include more top commands per user. You can also substitute "rare" for "top", if you wanted to find the least used.</P> Wed, 09 Feb 2011 12:58:20 GMT https://community.splunk.com/t5/Splunk-Search/Top-Values-of-2-fields/m-p/41474#M9610 Ron_Naken 2011-02-09T12:58:20Z https://community.splunk.com/t5/Splunk-Search/Top-Values-of-2-fields/m-p/41475#M9611 <P>Ron,</P> <P>Thanks for this. However, I guess I was not really clear with the inquiry. What I was looking for was a form search containing 2 input fields and matching those 2 fields and showing it as an event.</P> <P>I came up with a form search XML (could not paste everything) and it would seem to be ok. Would appreciate more inputs for improvement, thanks.</P> <P></P><FORM><BR /> <LABEL>MySearch</LABEL><BR /> <SEARCHTEMPLATE>index=hlr|search USERID=$USERID$ COMMAND=$COMMAND$</SEARCHTEMPLATE> ...<P></P></FORM> Thu, 10 Feb 2011 14:41:44 GMT https://community.splunk.com/t5/Splunk-Search/Top-Values-of-2-fields/m-p/41475#M9611 mcm10285 2011-02-10T14:41:44Z https://community.splunk.com/t5/Splunk-Search/Top-Values-of-2-fields/m-p/41476#M9612 <P>Ron, </P> <P>I used your example but it seems that Splunk can only handle 6 digits precision using the top search command.</P> Wed, 07 Mar 2012 16:03:23 GMT https://community.splunk.com/t5/Splunk-Search/Top-Values-of-2-fields/m-p/41476#M9612 lpolo 2012-03-07T16:03:23Z https://community.splunk.com/t5/Splunk-Search/Top-Values-of-2-fields/m-p/41477#M9613 <P>I got accurate results if I use:</P> <P>top limit=10 command,user</P> Wed, 07 Mar 2012 16:08:56 GMT https://community.splunk.com/t5/Splunk-Search/Top-Values-of-2-fields/m-p/41477#M9613 lpolo 2012-03-07T16:08:56Z