Resolve only the top 10 clientips in DNS

[jstockamp]

I'm trying to figure out the best way to have splunk resolve hostnames for only the top 10 clientips (by MB's transferred) from my access-combined logs. I've got the reverse DNS lookup working, and so for I've created the following search string:

eventtype="myevents" | eval MB = bytes/1024/1024 | chart sum(MB) as TotalMB by clientip | sort -TotalMB | head 10 | lookup dnsLookup ip as clientip | eval hostname=coalesce(host,clientip) | table hostname, TotalMB

I don't believe this is doing what I want though, it looks like its still trying to resolve all the clientip's, not just the top 10. What am I doing wrong here?

[ziegfried]

I'm quite sure it's only resolving the top 10 results, but it's doing this in preview mode. So it's executing the lookup with the partial results multiple times until the search is finished.