Sort and display top 5 values alone

[sushmitha_mj]

I am trying to display the top 5 memory used values by command - Meaning the top 5 commands with maximum usage, but I seem to be unable to get the output. Here is my search:

index=os sourcetype=ps host=xyz  | eval RSZ_MB=RSZ_KB/1024| stats max(RSZ_MB) as "Memory_Used" by COMMAND | sort -Memory_Used | top 5

Thanks,
Sushmitha

[NOUMSSI · Accepted solution]

hi try this:

index=os sourcetype=ps host=xyz | eval RSZ_MB=RSZ_KB/1024| stats max(RSZ_MB) as "Memory_Used" by COMMAND | sort -Memory_Used | top limit=5 Memory_Used

[sushmitha_mj]

Worked... Thanks...

[NOUMSSI]

Excellent! Please vote if the answer was helpful.