Sorting TP Column by State BY Top 5 Count

[tej8]

Base search AND "Return”="Finished” OR “body.message.Exit”=“Finished” “body.client.channel” IN (“CA”,“KY “,”NY “,”VA) | bin _time span=1s   | stats count AS TP by _time,“body.client.channel” | sort -TPS

I am trying to get sort by Top 3 TP Count in Each state.
How can sort by ASC & different search in descending order by each state?

-time                           State            TP
2019-06-04 19:38:35             CA               7
2019-06-04 19:40:50             CA               6
2019-06-04 19:40:50             CA               5
2019-06-04 19:40:50             CA               4
2019-06-04 19:30:47             KY               6
2019-06-04 19:31:24             KY               5
2019-06-04 19:31:24             KY               4
2019-06-04 19:31:24             KY               3
2019-06-04 19:31:27             NY               5
2019-06-04 19:31:27             NY               4
2019-06-04 19:31:27             NY               3
2019-06-04 19:31:27             NY               1
2019-06-04 19:33:27             VA               5
2019-06-04 19:38:47             VA               4
2019-06-04 19:38:47             VA               3
2019-06-04 19:38:47             VA               1

[evania]

Hi @tej8,

Did you have a chance to check out any answers? If it worked, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help you.

Thanks for posting!

[VatsalJagani]

Hi @tej8,

<your query> | top 3 TP by State | sort +State -TP
I'm guessing you want to sort first with ascending order of State but within that, you want to sort descending order or TP.

Hope this helps!!!

[renjith_nair]

@tej8,

Try

Your search
| sort -State,TP desc| dedup 3 State

OR

    Your search
    | sort -State,TP desc| streamstats count as _limit by State | where _limit <4

OR

    your search
    | top 3 TP by State|fields - count,percent