Splunk Search

head and sort a column inside a table generated by `stats`

RmDok
Loves-to-Learn Lots

`base search | stats values(zipcode), count(zipcode) as c by country | sort -c | head 10`

which gives me most appeared 10 countries in the base search. 

but I still need to count how many times each zipcode shows and get head 10 most zipcode under each country. 

Anyone can figure out how to write this?

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
base search 
| stats count by zipcode country 
| sort 0 country -num(count)
| streamstats count as rank by country
| where rank <= 10
0 Karma

RmDok
Loves-to-Learn Lots

Thank you, but that's not what I mean. 

base search will give

countryzipcode
USAAAAAA
CABBB BBB
USAAACCC
USAAAAAA

 

I want to find top 10 countries appear most in the country column

based on that, in each country, zipcode also need to be counted and sorted to get most appeard 10 zipcode as well

the expected output for above table is

countryzipcodecount
USAAAAAA2
 AAACCC1
CABBB BBB1

 

Thank you for your help!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults
| eval _raw="country	zipcode
US	AAAAAA
CA	BBB BBB
US	AAACCC
PE	AAAAAA
AR	AAAAAA
CA	BBB BBB
UK	AAACCC
BE	AAAAAA
US	AAAAAA
NL	BBB BBB
US	AAACCC
DE	AAAAAA
SA	AAAAAA
FR	BBB BBB
ES	AAACCC
NL	AAAAAA
US	AAAAAA
CA	BBB BBB
US	AAACCC
US	AAAAAA
US	AAAAAA
CA	BBB BBB
UK	AAACCC
BE	AAAAAA
US	AAAAAA
NL	BBB BBB
US	AAACCC
DE	AAAAAA
SA	AAAAAA
FR	BBB BBB
ES	AAACCC
BR	AAAAAA"
| multikv forceheader=1
| table country zipcode



| eventstats count by country
| sort -count country
| streamstats dc(country) as countryrank
| where countryrank<=10
| stats count values(countryrank) as countryrank by country zipcode
| sort country -count
| streamstats dc(zipcode) as rank by country
| where rank<=10
| sort countryrank rank
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Splunk Auto Ingestion Parallel Pipeline Scaling

Why this feature matters Many Splunk environments experience ingestion pressure long before the host is fully ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...