Using eval to Add Field for top Result?

[splunkyphil]

I need to create a new field to assign to the top results of a command using eval. 

Obviously this syntax doesn't work, so I'm looking for the correct query:

source="tutorialdata.zip*" | eval popular = top limit=5 itemId | stats count(action) by popular, action

Basically I only need the action stats of the top 5 itemId results of the following:

Sorry for the n00b question; I am just getting started with Splunk. Thanks for your time!

[bowesmana · Accepted solution]

Is this what you're after?

source="tutorialdata.zip*"
| eval X_{action}=action
| stats count as total count(X_*) as X_* by itemId
| sort - total
| head 5
| rename X_* as *
| fields - total

That will give you 5 rows of the most frequent itemId and then each column is a count of actions

Note the X_ prefix to the new field created is to allow the use of wildcards in the stats command to only collect the fields you're interested in.

You could also replace the eval/stats with 

| eval X_{action}=1
| stats count as total sum(X_*) as X_* by itemId

which may be slightly more efficient

[splunkyphil]

This works; thank you kindly!