How to add another field using top limit command?

[grotti]

Hello! I need some help from splunkers!!!

I'm using the search index=notable | search status_label=Closed | top limit=5 rule_title in the Splunk Enterprise Security, to list top 10 rule_title values.

But i need to bring the field "comment" of each rule_title in the table.

Can please help me?

Tks!!!

[gcusello]

Hi @grotti,

if you haven't too many comments for each row, you could use:

index=notable status_label=Closed 
| stats values(comment) AS comment BY rule_title
| sort 10 -count

Ciao.

Giuseppe

[bowesmana]

If the comment field is always the same for the rule, then just add the comment to the top command

index=notable 
| search status_label=Closed 
| top limit=5 rule_title comment