extract top ten values

[jip31jip31]

hi
i use this code
index="wineventlog" sourcetype="wineventlog:" SourceName="" Type="Critique" OR Type="Avertissement" | dedup _time SourceName | table _time SourceName | stats count by SourceName

and i would like to keep only the ten important values
how to do it please???

[tpeveler_splunk]

Hello,

The most straight forward way to handle this would be to use the top command.

A couple of things to note. You'll want to wildcard your sourcetype so that you do indeed pickup the wineventlog sourcetypes (i.e. sourcetype="wineventlog:*"). In addition, you'll want to wrap the OR condition on the Type fields in parenthesis as such (Type="Critique" OR Type="Avertissement")

SPL...

index="wineventlog" sourcetype="wineventlog:*" SourceName="" (Type="Critique" OR Type="Avertissement")
| dedup _time SourceName
| top limit=10 SourceName

[kmaron · Accepted solution]

index="wineventlog" sourcetype="wineventlog:" SourceName="" Type="Critique" OR Type="Avertissement" 
| dedup _time SourceName 
| table _time SourceName 
| stats count by SourceName
| sort - count limit=10

Sort by the field you want the top 10 of. (I used your count)
Then set limit= for how many you want to keep.

[adonio]

use the top command? ... | top limit=10 SourceName
or maybe sort command ... | sort 10 - count