Splunk Search

head and sort a column inside a table generated by `stats`

RmDok
Loves-to-Learn Lots

`base search | stats values(zipcode), count(zipcode) as c by country | sort -c | head 10`

which gives me most appeared 10 countries in the base search. 

but I still need to count how many times each zipcode shows and get head 10 most zipcode under each country. 

Anyone can figure out how to write this?

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
base search 
| stats count by zipcode country 
| sort 0 country -num(count)
| streamstats count as rank by country
| where rank <= 10
0 Karma

RmDok
Loves-to-Learn Lots

Thank you, but that's not what I mean. 

base search will give

countryzipcode
USAAAAAA
CABBB BBB
USAAACCC
USAAAAAA

 

I want to find top 10 countries appear most in the country column

based on that, in each country, zipcode also need to be counted and sorted to get most appeard 10 zipcode as well

the expected output for above table is

countryzipcodecount
USAAAAAA2
 AAACCC1
CABBB BBB1

 

Thank you for your help!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults
| eval _raw="country	zipcode
US	AAAAAA
CA	BBB BBB
US	AAACCC
PE	AAAAAA
AR	AAAAAA
CA	BBB BBB
UK	AAACCC
BE	AAAAAA
US	AAAAAA
NL	BBB BBB
US	AAACCC
DE	AAAAAA
SA	AAAAAA
FR	BBB BBB
ES	AAACCC
NL	AAAAAA
US	AAAAAA
CA	BBB BBB
US	AAACCC
US	AAAAAA
US	AAAAAA
CA	BBB BBB
UK	AAACCC
BE	AAAAAA
US	AAAAAA
NL	BBB BBB
US	AAACCC
DE	AAAAAA
SA	AAAAAA
FR	BBB BBB
ES	AAACCC
BR	AAAAAA"
| multikv forceheader=1
| table country zipcode



| eventstats count by country
| sort -count country
| streamstats dc(country) as countryrank
| where countryrank<=10
| stats count values(countryrank) as countryrank by country zipcode
| sort country -count
| streamstats dc(zipcode) as rank by country
| where rank<=10
| sort countryrank rank
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Free Professional Services for .conf26 Attendees

This year at .conf26, we are doing something a little different. We are bringing the best minds from ...

Defend at Machine Speed: Your Guide to Security Sessions at .conf26

Splunk .conf26   With threats moving at machine speed and attack surfaces expanding across hybrid ...

Where Innovation Takes Flight: The Splunk4Aviation Flight Sim Lands at .conf26

If you hear someone at .conf26 shouting "gear down, GEAR DOWN" across the show floor, you have found us.  The ...