top 1000 by appiD

[lpolo]

Hi,

From a set of log events I need to get the daily Top 1000 calls by each appId and clientId.
How can I do this in a single query without using the append command?

log events:

timestamp call=123 client=a appId=1
timestamp call=123 client=a appId=1
timestamp call=123  client=a appId=1
timestamp call=12 client=a appId=1
timestamp call=123 client=b appId=1
timestamp call=123 client=b appId=2
....
Nth event

So the result set based on these logs is :

day | call | client | appId | count
07/14/2020 | 123 | a | 1 | 3
07/14/2020 | 12 | a | 1 | 2
07/14/2020 | 123 | b | 1 | 1
07/14/2020 | 123 | b | 2 | 1 

The idea is to get the Top 1000 calls by each tuple of client : appId.
Thanks for your help.

[to4kawa]

index=<index name> sourcetype=<your sourcetype>
| bin _time span=1d
| stats count by _time call client appId
| eval day=strftime(_time,"%m/%d/%Y")
| table day call client appId count
| sort 1000 - count

how about this?

[lpolo]

Thanks for the query, It does not provide the intended result of Top 1000 calls for each tuple of client and appId.  I have been able to get the intended result by using the append command. The problem is that the query is too slow. I asked the question to find out if there is a trick that I am not aware of.... without using the append command.