For getting the most common values there's
top (http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Top ).
For getting the most rare values,
rare (http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rare ).
There's also a number of statistical functions available that might be suitable for you to use: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonStatsFunctions
if you want to filter the highest values, you can use a where condition, or an eval to normalize it.
sourcetype=mysourcetype | where myfield < 100 | timechart max(myfield) by host
sourcetype=mysourcetype | eval myfield=if(myfield<100,myfield,0) | timechart max(myfield) by host