My stats contain an entry called "index". How to get the head K of each index type? For example I want the top 10 in index=a, plus the top 10 in index=b, etc.
You need a thing to "top" by. For example, to see the top sourcetypes by index, do this:
index=* | top sourcetype by index
If you need the 10 most recent events by index, you can do this:
index=* | streamstats current=t count by index | where count<=10 | stats list(_raw) by index
