How can I filter the top / head values by a summed field (e.g. day)?

[markmcd]

I have a search that returns the number of 'views' of a product by day using a 'search xyz |bucket _time span=1d |stats sum(product_views) by _time,product_name' search.

I'd like to limit the search to the top 10 products by total views each day. How can I do this?

If I could add a 'rank' field by day, I'd be able to use a where clause but I can't figure out how to do that.

[kristian_kolb]

Could this work for you?

search xyz | top 10 product_name by date_mday

or you can bucket _time before top and use by _time

UPDATE:

what about

... | timechart per_day(product_view) by product_name limit=10 useother=false

---

UPDATE:

... | bucket span=1d _time | eventstats sum(product_view) as sum_views by product_name, _time | top 10 sum_views by _time 

/k

[kristian_kolb]

better. just check to see that the figures are correct. /k

[markmcd]

Cool... I'm getting closer! I apologise for not being clearer in the question, but I'm looking to get the top 10 for each day, not top 10 overall counted by each day. So I'd expect 10 rows for today, 10 for yesterday, 10 for the day before where each of the 'product_name' values could be different.

[kristian_kolb]

see update /k

[markmcd]

Because I've got a stats 'sum' function in my query I don't think I can use top as it performs a 'count'. Every row/tuple only occurs once in the results sent to top (it's partially aggregated when it's ingested unfortunately).