I have a data set that gives me an entry for each time a company runs a report in my system. I can easily put together a report that gives me a count of the reports by the company.
search * | stats count by company_name, report_name
Which returns the result:
Company Name Report Name count Company A Report 1 1919 Company A Report 2 643 Company A Report 5 454 Company B Report 3 400 Company D Report 3 391 Company A Report 6 336 Company C Report 1 269 Company A Report 3 266 Company B Report 1 229 Company A Report 10 176
What I'd actually like to do is to get a report that has one entry per company and returns the report with the highest count by the company, much like:
Company Name Report Name count Company A Report 1 1919 Company B Report 3 400 Company C Report 1 269 Company D Report 3 391