Top Command not Returning Results

[SMM10]

I am using a chart command to get a list of IP's and servers with an error. I am attempting to only get the top 10 results. For some reason when I do the top for IP I do not get results but if I do it for server I get results.

index=foo result=error
| chart count by server, ip
| top limit=10 ip

[somesoni2]

Once you run your chart command, you get one column for server and a column each for different ips in your result (column name will the value of ip), but there is no field called "ip" hence your top command fails. (it works for field server as it exists.

Assuming you want to get top 'ip' based on count, try something like this

index=foo result=error
| top limit=10 ip

[SMM10]

Doing that though loses the chart formatting that I wanted. IP's as the columns with servers as the rows. I would like to keep the chart formatting.

[somesoni2]

So do you want to show only the ip (as columns) which have top 10 total count of errors (across all servers)? 

[SMM10]

Yes so the two rows should be  servers and the columns should be the individual IP. For context this is from one of the learning labs so I believe I need to use chart and cant bypass it. I find it more strange that i can get the server name to show; though its only two values but the IP doesn't.