List top 10 values for each fields of an index

[fabienpe]

Hello,

I'm new to Splunk and despite searching extensively on this community site, I was not able to find a solution for what I thought was a rather simple problem. I would like to list, for each field in my index, the list of top 10 values.

I've tried different commande with stats values and top, and the following one gives me what's closest, but the output is messy:

index = my_index | multireport [top limit=10 field_1] [top limit=10 field_2] [top limit=10 field_3]

I do get the top values of each field presented in different columns of the output, but also get many empty cells:

field_1	field_2	field_3
	a top value of field_2
	a top value of field_2
	a top value of field_2
		a top value of field_3
		a top value of field_3
a top value of field_1
a top value of field_1

while i would like something like that:

field_1	field_2	field_3
a top value of field_1	a top value of field_2	a top value of field_3
a top value of field_1	a top value of field_2	a top value of field_3
	a top value of field_2

Has someone any idea how I could cleanup the output, and, ideally, easily loop through the column names so I don't have to write their name manually.

Thank!

[fabienpe]

Thanks!!

[ITWhisperer · Accepted solution]

index = my_index | top limit=10 field_1
| appendcols
  [search index = my_index | top limit=10 field_2]
| appendcols
  [search index = my_index | top limit=10 field_3]
| table field_1 field_2 field_3