How to return a group by value with the highest number of items?

[jbrenner]

How do I modify the following query to return the name of the FRUIT with the highest count:

index="myindex" URI="myuri" | stats count by FRUIT

Thanks,
Jonathan

[somesoni2]

You can do like this

index="myindex" URI="myuri" | top 1 FRUIT

This will give you name of top 1 FRUIT based on event count. You can adjust the number in top command to return more

[jbrenner]

Hi somesoni2,

That is perfect, thanks!

Now how could I modify your query to return the fruit name concatenated to the count in a single string like so:

 apple:2013

Thanks,
Jonathan

[somesoni2]

A simple eval statement will do that

above search | eval FRUIT=FRUIT.":".count 

[493669 · Accepted solution]

Try this:

index="myindex" URI="myuri" | stats count by FRUIT|stats max(count) as max

[jbrenner]

That gives me the count, but I want to return the name of the fruit.

Thanks,
Jonathan

[493669]

ok then try this it will give max count with name of fruit:

index="myindex" URI="myuri" | stats count by FRUIT|stats max(count) as max by FRUIT|head 1