Viewing beyond the top 10 results within an extracted field

[ebenioff]

I'm currently running searches to track the behavior of users on a particular mobile application. The first step in this is identifying which users to track, for which I run a query over a couple of weeks that returns an immense volume of logs and extract a userID field. When I select the userID field, Splunk shows me the top ten most prevalent userIDs, i.e. my most active users. This system has worked fine when I needed the highest activity users, but now I need low activity users as well and I'm wondering if there is any way to view the top 100 or all the userID's that are organized into the userID field.

[FunPolice]

You can't sort on a field that doesn't exist yet. Try replacing

| sort count | head 10 | stats count by userId 

with

 | stats count by userId | sort count

[twinspop]

| stats count by userID | sort - count

[ebenioff]

I got this to work for some sample queries, but can't get it to work for the actual query I need to run. What I've tried is:

index!="x" instance!="cs" logName="/mobile/direct/" logRecordTypeU=1 NOT logName="/mobile/direct/2.0.adobeair/" |fields logName, _time, organizationId, userId | rex field=logName "/mobile/direct/2..0.(?[^/])/.*" | where not isnull(device) | timechart span=2w dc(userId) as uniqueUsers by device | sort count | head 10 | stats count by userId

I'm pretty sure this is just a syntax error, but I don't know what exactly the error is.