How to achieve top 10 src_ip's along with top 10 urls for each src_ip?

[jhamot23]

I'm trying to run a query to figure out the top 10 src_ip's along with their top 10 urls visited. When I try the below query it's giving me every src_ip instead of just the top 10.

Any suggestions on how to limit the search for just the top 10 src_ip by top 10 url?

I've been running something like this:

index=firewall | stats count by src_ip, url
| sort 0 src_ip -count
| streamstats count as standings by src_ip
| where standings < 11
| eventstats sum(count) as total by category
| sort 0 -total src_ip -count

[efavreau]

@jhamot23  Did you know there's a top command? (it defaults to top 10, but this is configurable if you want)
See if this gets you in the neighborhood:

index=firewall
| top src_ip BY url

[jhamot23]

Appreciate the insights. Yes I just started playing around with the top command, and this did help get me in the neighborhood but was looking for a more cleaner list of just top 10 src_ips by top 10 urls visited. Looks like the suggestion below got me the list I was looking for. Thank you! 

[ITWhisperer · Accepted solution]

index=firewall 
| stats count by src_ip, url
| sort 0 src_ip -count
| streamstats count as standings by src_ip
| where standings < 11
| eventstats sum(count) as total by src_ip
| sort 0 -total src_ip -count
| streamstats count(eval(standings=1)) as rank
| where rank < 11

[jhamot23]

This is what I was looking for! Thank you!