How to TOP based on one of the stats by field ?

[sangs8788]

Hi

I have below query which gives me TOP 20 Requests based on REQUEST_COST regardless of the RequestType

| search RequestType= "Type1" OR RequestType="Type2"|
stats count as RCOUNT, sum(REQUEST_COST) as REQUEST_COST
P95(REQUEST_COST) as P95_REQUEST_COST

by R, RequestType|sort -REQUEST_COST | head 20

What i need is to get TOP 20 based on REQUEST_COST for each RequestType. That is TOP 20 Request for Type1 and TOP 20 Requests for Type2 requesttypes. How do i achieve this? Can someone help me on this ?

Thanks
SS

[niketn · Accepted solution]

@sangs8788 you can use streamstats to filter the results based on top count as per need.

Following is a run anywhere example based on Splunk's _internal index that gives Top 5 Components with Errors and Top 5 Components with Warning.

index=_internal sourcetype=splunkd log_level IN ("WARN","ERROR")
| stats count by component log_level
| sort 0 - log_level count
| streamstats count as rank by log_level
| search rank<=5

Please try out and adjust as per your needs.

[sangs8788]

Thanks. It worked.