How to limit results with multiple group by conditions?

[alchang]

Can the limit command be used with multiple conditions?

My search query is as follows | stats count as num by searchTerm, domain. I want to return the top 3 searchterms per domain. Is there a way to do that from the search bar in splunk UI?

Desired Output:

Domain searchTerm Number
Google ABC 100
Google DEF 50
Google GHI 25
Yahoo DEF 75
Yahoo ABC 60
Yahoo JKL 20
Bing DEF 80
Bing JKL 40
Bing GHI 20

[MuS]

Hi alchang,

try something like this:

your base search here 
| stats count as num by searchTerm, domain
| sort domain, -num 
| streamstats num as rank by domain
| where rank < 4

Hope this helps to get you started ...

cheers, MuS

[alchang]

Thanks! That worked. I hadn't worked much with streamstats before, but it looks very powerful. I will check it out. Offhand, do you know if streamstats works with report acceleration?

[MuS]

According to the docs http://docs.splunk.com/Documentation/Splunk/6.2.1/Report/Acceleratereports#How_reports_qualify_for_r... only transforming commands qualify for report acceleration. Find a list of transforming commands here http://docs.splunk.com/Splexicon:Transformingcommand

Feel free to accept this answer if it answered your question - you get some kudos as well 😉