In general, "top" command is useful for your requirement. Please note that "top" command show just 10 results by default, but you can use limit option to show 25 results. The command will be like as bellow.
sourcetype=
Please also refer to top command in manual.
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/top