Hey folks, I have data formatted as follows
time fielda fieldb
I want to find the top 3 values of fielda for each of fieldb, but for each result I need to know the time for which the top value occurred.
I found I can use top to get the top 3 fielda by fieldb, yet time is stripped from the table:
|top limit=3 fielda by fieldb
Is there a way to use top to maintain that data, or perhaps an alternative command or set of commands I can use to get what I'm looking for?
The data set includes a time value for each entry (hence the "time" field I listed in line 2 of my inquiry). That is the time of the entry containing fielda and fieldb. So I want that field maintained in the resulting top output. It could be time or anything else really.
What do you mean by "when the top value occurred"? The top command counts the number of events for each value of fielda and fieldb. Therefore the count covers a number of events, not just one. You could use the time of the first event for each value, or the last event or even something else ...