Searching for the top 10 using stats instead of top

Using the stats command in this recipe, we brought back all of the websites present in our web access logs and then sorted them by the number of unique referrals. Should we want to only show the top 10, we can simply add the head command at the end of our search as follows:

index=main sourcetype=access_combined | stats dc(clientip) AS Referals by referer_domain | sort - Referals | head 10

The head command keeps the first specified number of rows. In this case, as we have a descending sort, by keeping the first 10 rows, we are essentially keeping the top 10. Instead of using the head command, we could also use the limit parameter of the sort command as follows:

index=main sourcetype=access_combined | stats dc(clientip) AS Referals by referer_domain | sort - Referals limit=10

There is a great guide in the Splunk documentation to understand all of the different functions for stats, chart, and timechart, which is  available at https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonStatsFunctions.