Top command causing issues with stats commands

[alaking]

I am trying to audit bandwidth usage. The following search works as expected, except the URLS flood the URL field. I want the top 5:

Search here
| stats list(url) as URL sum(sent) as SentTotal sum(received) as ReceivedTotal by user
| eval Transferred=ReceivedTotal+SentTotal
| table user URL SentTotal ReceivedTotal Transferred
| sort -ReceivedTotal, -SentTotal 
| head 10

When I try to limit the domains listed using "top" like this:

Search here
| top limit=5 url by user
| stats list(url) as URL sum(sent) as SentTotal sum(received) as ReceivedTotal by user
| eval Transferred=ReceivedTotal+SentTotal
| table user URL SentTotal ReceivedTotal Transferred
| sort -ReceivedTotal, -SentTotal 
| head 10

The URL list is limited to 5 results per row, the problem is my sent/received/transferred fields go blank. And when I try putting top further down like this:

| stats list(url) as URL sum(sent) as SentTotal sum(received) as ReceivedTotal by user
| top limit=5 url by user
| eval Transferred=ReceivedTotal+SentTotal
| table user URL SentTotal ReceivedTotal Transferred
| sort -ReceivedTotal, -SentTotal 
| head 10

I get "No results found."

I am using Verbose mode and in every instance, I can see events on the events tab of the search window. I'm wondering if I am using top incorrectly.
Thanks is advance for reading and for any help you can provide.

[acharlieh]

This sounds like a job for the still undocumented multireport offhand something like this:

... | multireport 
         [top limit=5 url by user]
         [stats sum(sent) as SentTotal sum(received) as ReceivedTotal by user]
    | stats list(url) as URL values(*Total) as *Total by user
    | eval Transferred=ReceivedTotal+SentTotal
    | table user URL SentTotal ReceivedTotal Transferred
    | sort 10 -Transferred

So what's going on? Using multireport we generate statistics for your two transforming commands separately, we then pull the results back together using stats, and go on our merry way.

I should note that you can use trickery with appendpipe, eval, and where to get similar results without venturing into the undocumented parts of Splunk too it's just more verbose.