How to query where I can display x and y values as the top value?

[abhi04]

I have a tag which has four values i.e. a,b,x,y. But I want to display only the x and y values as the top value. I tried the below query but it is not working.

Source title=webatm* | eval t=if(tag==x OR tag==y)|top t

[micahkemp · Accepted solution]

Try:

 | eval t=if(tag="x" OR tag="y", tag, NULL)|top t

Inside an if (or other eval function), an un-quoted string represents a field name, and a quoted string represents the string itself.

Or, for multivalue fields, try:

| eval t=mvfilter(match(tag, "x") OR match(tag, "y"))
| top t

[abhi04]

Hi micahkemp,

The above query is including all the values a,b,x,y and not x,y only.
It's returning same as below query.
Source type=webatm*|top tag

I want only x and y values.

[micahkemp]

It doesn't when I run it:

| makeresults count=6| eval tag="x"
| append [| makeresults count=10 | eval tag="y"]
| append [| makeresults count=20 | eval tag="z"]
| eval t=if(tag="x" OR tag="y", tag, NULL)|top t

Is your tag value a multivalue field, perhaps, where one event has multiple values for tag? If that is the case try this instead:

| eval t=mvfilter(match(tag, "x") OR match(tag, "y"))
|top t

[abhi04]

Thanks Micahkemp.

It was anmultivalue field and the mvfilter is working.
Appreciated your help.Thanks a ton

[micahkemp]

Great! I've added the mvfilter version to my answer. If that answer solves your issue, please accept it so the question no longer appears open, and others have an easier time finding the answer.

[abhi04]

It still shows the percentage among all the values i.e. a,b,x,y and not between x and y only.

The above query result shows the same as below query

Source type=webatm* |top tag

But this is including all a,b,x and y values which I don't want.