Is there a way to limit the number of events included in the search result per user?

[ewanbrown]

I have some data, which includes a user id.

I can count the number of pageviews, and also the number of unique users who have viewed a page with this search

index=beacon BeaconType=pageview  | stats count, dc(INID)

I'd like to count the total number of pageviews, but cap each user to only have 10 views included. Do you know if this is possible?

Thanks

[somesoni2 · Accepted solution]

Try something like this. This will take only the 10 (if available) events per INID, rest logic is same.

index=beacon BeaconType=pageview | dedup 10 INID | stats count, dc(INID)

[ewanbrown]

Thanks a lot!