I have a search that returns the number of 'views' of a product by day using a 'search xyz |bucket time span=1d |stats sum(productviews) by time,productname' search.
I'd like to limit the search to the top 10 products by total views each day. How can I do this?
If I could add a 'rank' field by day, I'd be able to use a where clause but I can't figure out how to do that.
Could this work for you?
search xyz | top 10 product_name by date_mday
or you can
bucket _time before
top and use
... | timechart per_day(product_view) by product_name limit=10 useother=false
... | bucket span=1d _time | eventstats sum(product_view) as sum_views by product_name, _time | top 10 sum_views by _time
Cool... I'm getting closer! I apologise for not being clearer in the question, but I'm looking to get the top 10 for each day, not top 10 overall counted by each day. So I'd expect 10 rows for today, 10 for yesterday, 10 for the day before where each of the 'product_name' values could be different.
Because I've got a stats 'sum' function in my query I don't think I can use top as it performs a 'count'. Every row/tuple only occurs once in the results sent to top (it's partially aggregated when it's ingested unfortunately).