How to append search result with top 100 results?

[seva98]

I will try to explain my issue in the easiest possible way.

I have a result of a search that looks like this:

name1, name2, size
A      A      25
A      B      25
A      C      25
B      B      18
C      C      15
C      D      15

In the real project, the search is more complex but it follow this logic: A can have multiple B and always have the size of A.

I will need to retrieve the top 100 sizes but as this example is short, I would love to get the top 2 sizes and keep data from all other columns.

name1, name2, size
A      A      25
A      B      25
A      C      25
B      B      18

I really don't want to append this search with subsearch as search leading to this data is already very complex and takes a lot of time.
Is there any simple trick on how to achieve this?

[seva98 · Accepted solution]

Fixed it, thanks to @renjith.nair explanation. His solution just had issue for data where multiple name1 can have same size. There may be some extra unnecessary code but it works.

Sorting is done first so I get the biggest nodes at the top.
Then I cut the list to desired size (97 in this case)
Then I am looking if name1 is in filteredList.

| eval parent=if(name1=name2, 1, 0)
| sort name
| sort -size
| sort -parent
| eventstats list(name1) as uniquelist
| eval filteredlist=mvindex(uniquelist, 0, 96)
| eval find_match = if(match(name1, filteredlist), 1, 0)
| where name1=filteredlist
| fields - filteredlist, uniquelist

[renjith_nair]

@seva98,

Give this a try

"your search"|sort - size|eventstats list(size) size_list|eval size_list=mvdedup(size_list)
|eval hundredth=mvindex(size_list,99)
|where size >=hundredth | fields - size_list,hundredth

[seva98]

Almost, I have another issue when two different name1 have the same size for example name1=D => size=10, name1=E => size=10. Unfortunatelly mvdedup count them as one.