How to get the result of sorting in a group?

[flzhang132]

I want to get the result of sorting in the group.

[adonio · Accepted solution]

maybe try this:

| makeresults count=1
| eval data = "host1,a;host1,b;host2,c;host2,d;host3,a"
| makemv delim=";" data
| mvexpand data
| rex field=data "(?<project>[^,]+)\,(?<value>\S+)"
| table project value
| rename COMMENT as "the above creates data, below is the solution"
| streamstats count as number by project

hope it helps