How to find top 10 hosts after a sort?

[I-Man]

The following search will give the count of events by host and sort the hosts by count, highest to lowest.

index=summary source="SI Count By Host Every 10m" | stats count by orig_host | sort count

Now I just want to show the top 10 hosts based on their high count. Using the head command will show the first 10 hosts that are found and not the top 10 based on the count that i am trying to display. This seems easy enough but i cannot figure it out...

Feeling very noob right now, help is always appreciated.

Thanks, Iman

[renjujacob88]

index=summary source="SI Count By Host Every 10m" | stats count by orig_host | sort 10 - count

[rameshyedurla]

try this
index=_internal source=*license_usage.log type="Usage" | stats sum(b) AS volume by h | eval GB=round(volume/1024/1024/1024,5) | table h GB | sort 10 - GB | rename h AS Host

[I-Man]

index=summary source="SI Count By Host Every 10m" | stats count by orig_host | sort -count | head 10

The above search finally worked for me. There was some kind of bug going on that when I clicked on the top of a column to sort via ascending/descending order, the sort -count OR sort +count would make no difference as the column properties take seemed to take precedence. Not sure why but this only happened when the head function was not present. Weird. Thank you anyways for the quick response Genti.

[Genti · Accepted solution]

I think that's what you're looking for can be achieved by.

index=summary source="SI Count By Host Every 10m" | top limit=10 orig_host

However, if you would like to use your search you could also achieve the same by:

index=summary source="SI Count By Host Every 10m" | stats count by orig_host | sort limit=10 -count 

.gz