Splunk Search

Top 10 per group

alucarddjin
Path Finder

Is there a way to get the top 10 count for a number of groupings eg:

Col1    Col2    Count
G1        SG1     10
G1        SG2     8
G1        SG3     6
G2        SG4     21
G2        SG5     5
G2        SG6     1

So I have the top 10 for G1 then the top 10 for G2

0 Karma
1 Solution

woodcock
Esteemed Legend

Just do this:

... | sort 0 - Count
| dedup 10 Col1

View solution in original post

0 Karma

woodcock
Esteemed Legend

Just do this:

... | sort 0 - Count
| dedup 10 Col1
0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...