Using the stats command in this recipe, we brought back all of the websites present in our web access logs and then sorted them by the number of unique referrals. Should we want to only show the top 10, we can simply add the head command at the end of our search as follows:
index=main sourcetype=access_combined | stats dc(clientip) AS Referals by referer_domain | sort - Referals | head 10
The head command keeps the first specified number of rows. In this case, as we have a descending sort, by keeping the first 10 rows, we are essentially keeping the top 10. Instead of using the head command, we could also use the limit parameter of the sort command as follows:
index=main sourcetype=access_combined ...
