How to find top results by another field while including time in the table output?

[jfreund]

Hey folks, I have data formatted as follows

time fielda fieldb

I want to find the top 3 values of fielda for each of fieldb, but for each result I need to know the time for which the top value occurred.

I found I can use top to get the top 3 fielda by fieldb, yet time is stripped from the table:
|top limit=3 fielda by fieldb

Is there a way to use top to maintain that data, or perhaps an alternative command or set of commands I can use to get what I'm looking for?

[lguinn2]

Try this:

yoursearchhere
| sort 0 fieldb -fielda
| eval counter=1
| streamstats current=true global=f sum(counter) as index by fieldb
| where index < 4
| table fieldb fielda _time

[jfreund]

The data set includes a time value for each entry (hence the "time" field I listed in line 2 of my inquiry). That is the time of the entry containing fielda and fieldb. So I want that field maintained in the resulting top output. It could be time or anything else really.

[somesoni2]

Do you mean maximum value instead of top value for fielda?

[lguinn2]

I think that is what jfreund meant

[lguinn2]

What do you mean by "when the top value occurred"? The top command counts the number of events for each value of fielda and fieldb. Therefore the count covers a number of events, not just one. You could use the time of the first event for each value, or the last event or even something else ...