Splunk Search

top N results of values(X)

Path Finder

I have a column list received from "values(mymail)"


I need to get top/head N results of that list with the idea that values(mymail) can reach thousands of rows.

The whole search string related to the question is :

$SEARCH | stats count dc(mymail) as unique count(mymail) as hits values(mymail) as list by VAR

How do I do that ? 🙂

I tried with eval
just before |stats like eval email_list=(values(mymail)|head 10 ), but it seems not right

Tags (3)
0 Karma


You could maybe use the following to break out the individual items in the list field but am having trouble imagining what the rest of your stats command output is - haven't had enough caffeine yet I suppose.

| makemv list | mvexpand list

At any rate you would then need another stats (+ sort & head) or top command to then get your top X.

0 Karma

Revered Legend

Try something like this

$SEARCH | stats count dc(mymail) as unique count(mymail) as hits values(mymail) as list by VAR 
| eval sno=mvrange(0,10,1) | eval list=mvzip(list,sno,",") |nomv list| eval list=replace(list,"(,\d+)"," ") | makemv list

The no '10' in the mvrange command denotes you will be returned first 10 values from the multivalued field 'list'

0 Karma
Get Updates on the Splunk Community!

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...

There's No Place Like Chrome and the Splunk Platform

WATCH NOW!Malware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

Customer Experience | Join the Customer Advisory Board!

Are you ready to take your Splunk journey to the next level? 🚀 We invite you to join our elite squad ...