index=omi_Uat host=DEFRNCMP* sourcetype=all_events_attributes | eval {idx} = elt | fields ID,UMN,TicketID,node | top limit=10 UMN
This is the query I'm trying to get top 10 UMN . How can I get field values of ID,TicketID,node for each UMN
You can manually perform the top command after a stats that pulls the latest _raw event using the below query:
index=omi_Uat host=DEFRNCMP* sourcetype=all_events_attributes
| eval {idx} = elt
| fields ID,UMN,TicketID,node
| stats count values(ID) as ID values(TicketID) as TicketID values(node) as node by UMN
| eventstats sum(count) as TotalCount
| eval percent=round((count/TotalCount)*100,6)
| sort 0 - count
| streamstats count as counter
| where counter<=10
| fields - TotalCount counter
If you require an other field that will make it a bit tricker, but it is possible:
index=omi_Uat host=DEFRNCMP* sourcetype=all_events_attributes
| eval {idx} = elt
| fields ID,UMN,TicketID,node
| stats count values(ID) as ID values(TicketID) as TicketID values(node) as node by UMN
| eventstats sum(count) as TotalCount
| eval percent=round((count/TotalCount)*100,6)
| sort 0 - count
| streamstats count as counter
| eval UMN=if(counter>10, UMN, "Other")
| fields - TotalCount counter
| stats sum(count) as count sum(percent) as percent values(ID) as ID values(TicketID) as TicketID values(node) as node by UMN
| sort 0 - count
Sorry, I misread the initial request and the first result was providing _raw values but you wanted specific fields. I have just adjusted it for that.
Thanks for your help.
Glad I could help!
I think you can do a join and then search again.
index=omi_Uat host=DEFRNCMP* sourcetype=all_events_attributes | eval {idx} = elt | fields ID,UMN,TicketID,node | top limit=10 UMN
| join UMN
[search index=omi_Uat host=DEFRNCMP* sourcetype=all_events_attributes | eval {idx} = elt | fields ID,UMN,TicketID,node]
| fields UMN ID TicketID node
Thanks . It worked 🙂