Splunk Search

head and sort a column inside a table generated by `stats`

RmDok
Loves-to-Learn Lots

`base search | stats values(zipcode), count(zipcode) as c by country | sort -c | head 10`

which gives me most appeared 10 countries in the base search. 

but I still need to count how many times each zipcode shows and get head 10 most zipcode under each country. 

Anyone can figure out how to write this?

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
base search 
| stats count by zipcode country 
| sort 0 country -num(count)
| streamstats count as rank by country
| where rank <= 10
0 Karma

RmDok
Loves-to-Learn Lots

Thank you, but that's not what I mean. 

base search will give

countryzipcode
USAAAAAA
CABBB BBB
USAAACCC
USAAAAAA

 

I want to find top 10 countries appear most in the country column

based on that, in each country, zipcode also need to be counted and sorted to get most appeard 10 zipcode as well

the expected output for above table is

countryzipcodecount
USAAAAAA2
 AAACCC1
CABBB BBB1

 

Thank you for your help!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults
| eval _raw="country	zipcode
US	AAAAAA
CA	BBB BBB
US	AAACCC
PE	AAAAAA
AR	AAAAAA
CA	BBB BBB
UK	AAACCC
BE	AAAAAA
US	AAAAAA
NL	BBB BBB
US	AAACCC
DE	AAAAAA
SA	AAAAAA
FR	BBB BBB
ES	AAACCC
NL	AAAAAA
US	AAAAAA
CA	BBB BBB
US	AAACCC
US	AAAAAA
US	AAAAAA
CA	BBB BBB
UK	AAACCC
BE	AAAAAA
US	AAAAAA
NL	BBB BBB
US	AAACCC
DE	AAAAAA
SA	AAAAAA
FR	BBB BBB
ES	AAACCC
BR	AAAAAA"
| multikv forceheader=1
| table country zipcode



| eventstats count by country
| sort -count country
| streamstats dc(country) as countryrank
| where countryrank<=10
| stats count values(countryrank) as countryrank by country zipcode
| sort country -count
| streamstats dc(zipcode) as rank by country
| where rank<=10
| sort countryrank rank
0 Karma
Get Updates on the Splunk Community!

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...