Syntax for 'top x application by usage per source ip'

[ahmadsaadwarrai]

I have raw search:

| ess eaddr=172.20.8.60:9200 index=nuage_dpi_flowstats-* tsfield=timestamp query="EnterpriseName=Lismore Diocese"
| eval _time=strftime(_time/1000, "%Y-%m-%d %H:%M:%S")
| stats sum(TotalMB) as "Total(MB)" by DstIp, L7ClassEnhanced, DestinationNSG
| search NOT DestinationNSG=ULT1_NSGX

How do I add top parameters, saying top x applications based on usage per source IP.

[darshildave]

| stats values('Total(MB)') by source_ip | sort 0 - 'Total(MB)' | head limit=x

Here 'Total(MB)' is the usage and limit returns first x records from results.

[ahmadsaadwarrai · Accepted solution]

I am able to do it using below search:

| ess eaddr=172.20.8.60:9200 index=nuage_dpi_flowstats-* tsfield=timestamp query="EnterpriseName=Lismore Diocese"
| eval _time=strftime(_time/1000, "%Y-%m-%d %H:%M:%S")
| stats sum(TotalMB) as "Total(MB)" by DstIp, L7ClassEnhanced, DestinationNSG
| sort DstIp -"Total(MB)"
| eval counter = 1
| streamstats sum(counter) as seqNo by DstIp
| where seqNo < 5
| fields - counter seqNo
| search NOT DestinationNSG=ULT1_NSGX1

[nabeel652]

<your search> | top 10 application by sourceIP