There is a way to do this in Splunk using the set commands ( http://www.splunk.com/base/Documentation/latest/SearchReference/Set ) , but it is likely that there is a far more efficient way to do it without the set command or a bunch of subsearches. (By filtering the data all at once, and then doing ... | top 5 by subsetname | stats count by commonfield , but whether this is possible depends on the specific conditions and the data).
In general, it may be a good idea to give examples or describe what your incoming data is and what you want out, rather that specifying the specific algorithm, because a lot of set-based/table-based algorithms may be replaced with better algorithms that take better advantage of how Splunk processes data.
... View more