How to filter top 3 counts over each group?

[amylala]

Here is data I get after count by Message and Error Code.

Message ErrorCode Count
Msg1 1000 500
Msg1 1001 400
Msg1 1002 300
Msg1 1003 200
Msg1 1004 100
Msg2 2000 550
Msg2 2001 450
Msg2 2002 350
Msg2 2003 250
Msg2 2004 150

I want top 3 count of each Msg. How can I get result as below?
Message ErrorCode Count
Msg1 1000 500
Msg1 1001 400
Msg1 1002 300
Msg2 2000 550
Msg2 2001 450
Msg2 2002 350

[pradeepkumarg · Accepted solution]

... | sort Message -count | dedup 3 Message

[amylala]

Thanks, gpradeepkumarreddy.
This method is more simple. But It is sort by count after dedup.
I need to sort again at the end.

[amylala]

Sorry, my mistake, no need to sorting is not changed after dedup

[somesoni2]

Try something like this

Your current search giving Count by Message and ErrorCode | sort 0 Message -Count | streamstats count as rank by Message | where rank<=3 | fields - rank 

[amylala]

Thanks, somesoni2.
This is really what I want. 🙂

[jeffland]

Does this do the trick?

... | top limit=3 showperc=f ErrorCode by Message

Do it instead of stats count by Message ErrorCode.

[amylala]

Thanks, jeffland. It works! 🙂

Do you have any idea if I want to search with data model? (|tstats command)
Seem I can only use raw search now.

[jeffland]

Sorry, I don't know why you wouldn't be able to use this with a data model. I must admit though that I don't work with data models a lot.