Splunk Search

head and sort a column inside a table generated by `stats`

RmDok
Loves-to-Learn Lots

`base search | stats values(zipcode), count(zipcode) as c by country | sort -c | head 10`

which gives me most appeared 10 countries in the base search. 

but I still need to count how many times each zipcode shows and get head 10 most zipcode under each country. 

Anyone can figure out how to write this?

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
base search 
| stats count by zipcode country 
| sort 0 country -num(count)
| streamstats count as rank by country
| where rank <= 10
0 Karma

RmDok
Loves-to-Learn Lots

Thank you, but that's not what I mean. 

base search will give

countryzipcode
USAAAAAA
CABBB BBB
USAAACCC
USAAAAAA

 

I want to find top 10 countries appear most in the country column

based on that, in each country, zipcode also need to be counted and sorted to get most appeard 10 zipcode as well

the expected output for above table is

countryzipcodecount
USAAAAAA2
 AAACCC1
CABBB BBB1

 

Thank you for your help!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults
| eval _raw="country	zipcode
US	AAAAAA
CA	BBB BBB
US	AAACCC
PE	AAAAAA
AR	AAAAAA
CA	BBB BBB
UK	AAACCC
BE	AAAAAA
US	AAAAAA
NL	BBB BBB
US	AAACCC
DE	AAAAAA
SA	AAAAAA
FR	BBB BBB
ES	AAACCC
NL	AAAAAA
US	AAAAAA
CA	BBB BBB
US	AAACCC
US	AAAAAA
US	AAAAAA
CA	BBB BBB
UK	AAACCC
BE	AAAAAA
US	AAAAAA
NL	BBB BBB
US	AAACCC
DE	AAAAAA
SA	AAAAAA
FR	BBB BBB
ES	AAACCC
BR	AAAAAA"
| multikv forceheader=1
| table country zipcode



| eventstats count by country
| sort -count country
| streamstats dc(country) as countryrank
| where countryrank<=10
| stats count values(countryrank) as countryrank by country zipcode
| sort country -count
| streamstats dc(zipcode) as rank by country
| where rank<=10
| sort countryrank rank
0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...