Splunk Search

Display top 3 Employees by Class Frequency

efelder0
Communicator

I have 2 fields in CSV that I want to only display the top 3 employees by the Class frequency. I know the Top command will suffice, but not sure of the syntax.

Here is a sampling of data:
Employee_ID Class_Frequency
tsmith 2388
mjones 81
smurphy 6591
tpayne 1309
jjones 109

Tags (2)
0 Karma

jfreund
Explorer

| top limit=3 Class_Frequency by Employee_ID showcount=f showperc=f

0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee
 * | chart count(Employee_ID) as count by Class_Frequency | sort - count | head 3

or


 * | stats count(Employee_ID) by Class_Frequency | sort - count | head 3

efelder0
Communicator

sort - Classification_Frequency | head 3 worked..

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...