Splunk Search

How do I write a search to find the top 10 max by field?

SAPrabhakar
Explorer

I am attempting to get a listing of the max top 10 by a field.

I am able to get the the top 10 by doing this:

[search goes here] | top limit=10 message.facets.duration

I can get the max by doing:

[search goes here]  | stats max(message.facets.duration)

I am trying to figure out how to get the max top 10.

0 Karma
1 Solution

somesoni2
Revered Legend

How about this

[search goes here] | sort 10 -message.facets.duration

View solution in original post

somesoni2
Revered Legend

How about this

[search goes here] | sort 10 -message.facets.duration

SAPrabhakar
Explorer

Yea that did the trick. I over thought by quite a bit. Thanks

0 Karma

twinspop
Influencer

top gives you the top occurrences of a field value. So if your duration field had "1" as a value more times than values of "100000", "1" would be the top entry. Probably not what you wanted! 🙂

Get Updates on the Splunk Community!

Celebrating Fast Lane: 2025 Authorized Learning Partner of the Year

At .conf25, Splunk proudly recognized Fast Lane as the 2025 Authorized Learning Partner of the Year. This ...

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...