How to get top results for a particular field

[samsplunkd]

Hi,

I have a field called API with various different values and all the stats for those APIs are summary indexed. I want to extract results for top 5 APIs and then I want to perform operations only on those results.
When I use "top", it suppresses the other fields(results), shows some stats (count, %) and I cannot perform any other operation once top is used.

Is there a way I can extract all the results for top 5 APIs and retain the log entry as well to perform other operations on other fields associated with those APIs.

Thanks

[Ayn]

Basically this is a classic example of when you can use a subsearch, but there are some other clever ways of doing this, too. This question and its answers seems relevant to what you're asking: http://splunk-base.splunk.com/answers/69877/show-parent-query-and-subquery-at-the-same-time