How do I return only 5 ACCOUNT_IDs from my "chart list(ACCOUNT_ID) by script" search?

[ARTHI]

chart list(ACCOUNT_ID) by script  

I am getting a chart with script and list of ACCOUNT_ID. I want only 5 ACCOUNT_ID'S in the list. I tried the limit parameter and head command, but could not get the expected result.

[martin_mueller · Accepted solution]

Your question could do with a few more details, so I'll hazard a guess:

... | top 0 ACCOUNT_ID script | streamstats count by script | where count <= 5 | stats values(ACCOUNT_ID) by script

That's assuming you want the most frequent five accounts.

If you just want to truncate the lists you already have, you could use the eval function mvindex(field, start, end)to do that after your chart command.

[ARTHI]

Thanks martin...
I am able to get the most frequent 5 accounts...
What if the Chart has two List like chart list(ACCOUNT_ID), list(institute) by script and I have to restrict the count only for list of ACCOUNT_ID.....above mentioned solution is not wrking

[martin_mueller]

That depends on the requirements. Is that a list of insitutes per account, for those five accounts, for all accounts, ...?