How to get top 10 values of a column and its raw data for each value

[anz999]

index=omi_Uat host=DEFRNCMP* sourcetype=all_events_attributes | eval {idx} = elt | fields ID,UMN,TicketID,node | top limit=10 UMN

This is the query I'm trying to get top 10 UMN . How can I get field values of ID,TicketID,node for each UMN

[dmarling]

You can manually perform the top command after a stats that pulls the latest _raw event using the below query:

index=omi_Uat host=DEFRNCMP* sourcetype=all_events_attributes 
| eval {idx} = elt 
| fields ID,UMN,TicketID,node 
| stats count values(ID) as ID values(TicketID) as TicketID values(node) as node by UMN
| eventstats sum(count) as TotalCount
| eval percent=round((count/TotalCount)*100,6)
| sort 0 - count
| streamstats count as counter
| where counter<=10
| fields - TotalCount counter

If you require an other field that will make it a bit tricker, but it is possible:

index=omi_Uat host=DEFRNCMP* sourcetype=all_events_attributes 
| eval {idx} = elt 
| fields ID,UMN,TicketID,node 
| stats count values(ID) as ID values(TicketID) as TicketID values(node) as node  by UMN
| eventstats sum(count) as TotalCount
| eval percent=round((count/TotalCount)*100,6)
| sort 0 - count
| streamstats count as counter
| eval UMN=if(counter>10, UMN, "Other")
| fields - TotalCount counter
| stats sum(count) as count sum(percent) as percent values(ID) as ID values(TicketID) as TicketID values(node) as node by UMN
| sort 0 - count

[dmarling]

Sorry, I misread the initial request and the first result was providing _raw values but you wanted specific fields. I have just adjusted it for that.

[anz999]

Thanks for your help.

[dmarling]

Glad I could help!

[jodyfsu]

I think you can do a join and then search again.

index=omi_Uat host=DEFRNCMP* sourcetype=all_events_attributes | eval {idx} = elt | fields ID,UMN,TicketID,node | top limit=10 UMN
| join UMN
[search index=omi_Uat host=DEFRNCMP* sourcetype=all_events_attributes | eval {idx} = elt | fields ID,UMN,TicketID,node]
| fields UMN ID TicketID node

[anz999]

Thanks . It worked 🙂