I have a relatively simple query with which I am evaluating a new field. I'd like to get the top values of this new field however the results are not what I expect:
Base Query:
index=lisum_data vendord=* user_hash=* featurename=*
| stats count by user_hash
| eval TimeUsed=count*10/60
| where TimeUsed > .5
| sort TimeUsed desc
| fields - count
Attempted:
index=lisum_data vendord=* user_hash=* featurename=*
| stats count by user_hash
| eval TimeUsed=count*10/60
| where TimeUsed > .5
| sort TimeUsed desc
| fields - count
| top limit=25 TimeUsed
I want a table of the top 25 users (user_hash) by total time used(TimeUsed)
Hey !
You were really closed, try that :
index=lisum_data vendord=* user_hash=* featurename=*
| stats count by user_hash
| eval TimeUsed=count*10/60
| where TimeUsed > .5
| sort 25 -TimeUsed
| fields - count
Let me know 🙂
Kail
Your sort command should be sort 0 - TimeUsed