Below is a sample from the end of my search:
...
|stats count by area, type
|sort -count
Using the Trellis layout, split on AREA, six pie charts counting by TYPE are returned. I’d like to display the Top 10 types for each area. If the top command can’t be used, how can I group anything over the first 10 results in an “other” pie segment?
Hi @ejohn, I am not sure why you say top
command can not be used. It is most ideal command to be used for this scenario. As per your description you should be using the following command:
<YourBaseSearch>
| top 10 area by type
Then use Trellis with Split by
option as area
from UI in Edit mode Or the following Simple XML configuration:
<option name="trellis.splitBy">area</option>
PS: In case you want something of reverse effect you can change to
<YourBaseSearch>
|top 10 type by area
Please try out and confirm.
Hi @ejohn, I am not sure why you say top
command can not be used. It is most ideal command to be used for this scenario. As per your description you should be using the following command:
<YourBaseSearch>
| top 10 area by type
Then use Trellis with Split by
option as area
from UI in Edit mode Or the following Simple XML configuration:
<option name="trellis.splitBy">area</option>
PS: In case you want something of reverse effect you can change to
<YourBaseSearch>
|top 10 type by area
Please try out and confirm.
Hi @niketnilay. I knew top
command was ideal, but I missed adding the by area
portion in some attempts, and tried it in conjunction with stats count
in others. The grouping portion of my question was just an alternative option for displaying the information, if anyone had ideas. There was a small typo in the solution you provided, but the following displayed exactly what I needed:
…|top limit=10 type by area
Thanks for the help!
Hi @ejohn, it is not type. Both | top 10 area by type
and | top limit=10 area by type
are the same. It is up to our convenience which one we choose.
In fact 10 is the default value for top so | top area by type
should also give you same results. 🙂
Oh... ok @niketnilay. I must have entered something wrong the first time, because no results were returning and it worked when I added the limit. I tried all three solutions today with success. Thanks again!