I'm currently running searches to track the behavior of users on a particular mobile application. The first step in this is identifying which users to track, for which I run a query over a couple of weeks that returns an immense volume of logs and extract a userID field. When I select the userID field, Splunk shows me the top ten most prevalent userIDs, i.e. my most active users. This system has worked fine when I needed the highest activity users, but now I need low activity users as well and I'm wondering if there is any way to view the top 100 or all the userID's that are organized into the userID field. ... View more