Note: botsv1 means absolutely nothing to most volunteers in this forum.  If there is something special about this dataset, you need to explain very clearly.  Also important: when you have a sample code that doesn't do what you wanted, you need to illustrate what it actually outputs, and explain why it doesn't meet your requirement if that's not painfully obvious.  Did your sample code give you desired result? Based on your sample code, I speculate that so-called URI is in the field src_ip?  Why do you use list, not values?  What is the use of list of count?  What's wrong with this simpler formula?   index=indexname |stats values(domain) as Domain count as total by src_ip | sort -total | head 10   Without SPL, can you explain/illustrate what data is like (anonymize as necessary), illustrate what the end result look like using illustrated data, and describe the logic between that data and your desired result?  This is the best way to get help with data analytics. i can speculate that you want to display individual count of domains by src_ip, too.  If so, designing a proper visual vocabulary is a lot better.  For example:   index=indexname |stats count by domain,src_ip | sort - count |stats list(count . " (" . domain . ")") as DomainCount, sum(count) as total by src_ip |sort - total DomainCount | head 10 |fields - total   Just note that this is mathematically equivalent to your code.  So, you will need to illustrate the output and explain why that's not the desired result.