Splunk Search

head and sort a column inside a table generated by `stats`

RmDok
Loves-to-Learn Lots

`base search | stats values(zipcode), count(zipcode) as c by country | sort -c | head 10`

which gives me most appeared 10 countries in the base search. 

but I still need to count how many times each zipcode shows and get head 10 most zipcode under each country. 

Anyone can figure out how to write this?

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
base search 
| stats count by zipcode country 
| sort 0 country -num(count)
| streamstats count as rank by country
| where rank <= 10
0 Karma

RmDok
Loves-to-Learn Lots

Thank you, but that's not what I mean. 

base search will give

countryzipcode
USAAAAAA
CABBB BBB
USAAACCC
USAAAAAA

 

I want to find top 10 countries appear most in the country column

based on that, in each country, zipcode also need to be counted and sorted to get most appeard 10 zipcode as well

the expected output for above table is

countryzipcodecount
USAAAAAA2
 AAACCC1
CABBB BBB1

 

Thank you for your help!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults
| eval _raw="country	zipcode
US	AAAAAA
CA	BBB BBB
US	AAACCC
PE	AAAAAA
AR	AAAAAA
CA	BBB BBB
UK	AAACCC
BE	AAAAAA
US	AAAAAA
NL	BBB BBB
US	AAACCC
DE	AAAAAA
SA	AAAAAA
FR	BBB BBB
ES	AAACCC
NL	AAAAAA
US	AAAAAA
CA	BBB BBB
US	AAACCC
US	AAAAAA
US	AAAAAA
CA	BBB BBB
UK	AAACCC
BE	AAAAAA
US	AAAAAA
NL	BBB BBB
US	AAACCC
DE	AAAAAA
SA	AAAAAA
FR	BBB BBB
ES	AAACCC
BR	AAAAAA"
| multikv forceheader=1
| table country zipcode



| eventstats count by country
| sort -count country
| streamstats dc(country) as countryrank
| where countryrank<=10
| stats count values(countryrank) as countryrank by country zipcode
| sort country -count
| streamstats dc(zipcode) as rank by country
| where rank<=10
| sort countryrank rank
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Index This | What travels the world but is also stuck in place?

April 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data

Realizing the full potential of your Splunk investment requires more than just understanding current usage; it ...

Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...

As data volumes continue to grow and environments become more distributed, managing and optimizing data ...