Need Help with query

[omprakash9998]

Trying build a time chart for Top 10 CPU consuming Processes for a Linux host for a given timeframe.

index=os host=xxxxxx source=top pctCPU != 0.0 
| table COMMAND, pctCPU _time | sort - pctCPU | dedup COMMAND | head 10

I am trying to get a timechart based for the pctCPU  usage only for these 10 COMMANDS. 

Thanks

[ITWhisperer · Accepted solution]

You could try something like this

index=os host=xxxxxx source=top pctCPU != 0.0 
| fields COMMAND, pctCPU _time 
| eventstats max(pctCPU) as maxpctCPU by COMMAND
| sort - maxpctCPU COMMAND
| streamstats dc(COMMAND) as rank
| where rank <= 10
| fields - rank maxpctCPU
| timechart span=1h max(pctCPU) as maxpctCPU by COMMAND