Splunk Search

Top 10 per group

alucarddjin
Path Finder

Is there a way to get the top 10 count for a number of groupings eg:

Col1    Col2    Count
G1        SG1     10
G1        SG2     8
G1        SG3     6
G2        SG4     21
G2        SG5     5
G2        SG6     1

So I have the top 10 for G1 then the top 10 for G2

0 Karma
1 Solution

woodcock
Esteemed Legend

Just do this:

... | sort 0 - Count
| dedup 10 Col1

View solution in original post

0 Karma

woodcock
Esteemed Legend

Just do this:

... | sort 0 - Count
| dedup 10 Col1
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

At .conf26, Don’t Just See What’s Next. Help Shape It at Innovation Labs.

Long before a new capability reaches the keynote stage, it begins as an idea waiting to be tested. At ...

Forwarder Topology Guidance: Intermediate HF vs Intermediate UF

Why Universal Forwarders Should Not Be Used as Intermediate Forwarders A practical Splunk forwarding topology ...

Data Management Digest – August 2026

Data Management Digest   Welcome to the August 2026 edition of Data Management Digest! August was a big month ...