How to count top results in each column?

[marisstella]

Hi everyone,
Trying to find out the top 10 values from different host long_message index functionality..
So tried like index=* "error" OR "FAIL" OR "fatal"| stats values (functionality) values(correlatioid) values(loan_num) values(host) count by log_message | sort -count

So it is showing top errors with functionality host loan_num details for each and every error.
My requirement is i want achieve top errors count from particular host or fuctionality..
It is showing like
Functionality:
Abc
Xyz
123
Let's say If the Abc functionality has more errors.. in the table it should give the count of Abc along with percentage among all the obtained errors..
Like this..
Functionality:
Abc- 109 98% amoung
Xyz - 1 1%
123 1 1%

Any suggestions?
Similarly i want see the top errors causing from different sources..

[to4kawa]

your query:

 index=* "error" OR "FAIL" OR "fatal"
| stats values(functionality) values(correlatioid) values(loan_num) values(host) count by log_message 
| sort - count

Simply:

 index=* "error" OR "FAIL" OR "fatal"
| top functionality

[marisstella]

how it will show the count for each row in functionality column?

[to4kawa]

the result of top is like below

functionality count percent
Abc                109     98%
Xyz                  1      1%
123                  1      1%

cf. top

[marisstella]

How can we compare these values by log messages?
Let's say there is an error 501..
I need table like this..

Log_message. Functionality: host:

Error-501 abc 98 98%. Bjk500. 70 70%
Xyz 01 1%. Bjk400. 20 20%
123 01 1%. Bjk300. 10 10%

Like that we want correlate all sources with the specifyerror..

[to4kawa]

I don't know the details of your logs.
so , I can't create query.