I may be wrong but you can try rare command . have a look at this doc http://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Rare#2._Return_the_least_common_values_organized_by_host | rare limit=<int> appended_event by user_name role specify <int> accordingly. let me know if this helps! ... View more