Can you help me use the "sort" and "top" commands in a search?

[Mohsin123]

Hi ,

I have a rsult set like this below

status  URL value
status-500  identifiers 539
status-500  customer    529
status-400  dub 421
status-400  customer    413
status-500  eSIMEntitlement 387
status-400  identifiers 264
status-400  iot 193
status-400  token   157
status-500  msisdn  88
status-500  token   33
status-400  pushnotification    8
status-400  loyalty 3
status-500  iot 3
status-400  eSIMEntitlement 1
status-500  pushnotification    1
status-400  account 0
status-400  catalog 0
status-400  moat    0
status-400  msisdn  0
status-400  oauth2  0

what i need to do is top 5 URLs with status-400 and top 5 URLs with status-500 will be only remaining in the result set

is that possible?

[Vijeta · Accepted solution]

| stats count by status URL| sort  -count status| streamstats count as C by status| where C<=5

[Mohsin123]

Thanks @Vijeta Now i have acheieved upto this....i need to present this into buckets of status-400 and status-500
means on x-axis : bucket -400 , buckeyt-500 and on y axis url list

status URL-Bucket
status-400 account
status-400 catalog
status-400 customer
status-400 dub
status-400 eSIMEntitlement
status-500 account
status-500 catalog
status-500 customer
status-500 dub
status-500 eSIMEntitlement

i tried using thids

|stats values(URL) as URL-Bucket by status

its not working