Top Results After Timechart

[rhum_defintel]

I don't really know how to explain this so I will do my best.

I have a bunch of data that I want to analyze. Each line represents an event and it contains a timestamp. I use the following command to narrow down the results to those during times where there is a lot of data in a short period of time.

sourcetype="csv-4" | timechart span="1m" count | eventstats avg(count) as threshold | where count/1.1 > threshold | eventstats median(count) as threshold | where count > threshold | timechart span="5m" count | where count > 0

In the data, there is a field called NAME. I want to find the top ten names within the filtered out results. I tried this but it did not work:

sourcetype="csv-4" | timechart span="1m" count | eventstats avg(count) as threshold | where count/1.1 > threshold | eventstats median(count) as threshold | where count > threshold | timechart span="5m" count | where count > 0 | top NAME

Could someone please help me?

[lguinn2]

The problem is that you have summarized the data in the first timechart command - after that point you are working with the summarized data as it appears in the timechart. There is no NAME in the timechart results.

What exactly do you mean by "within the timechart results"? I think you could probably run a second search that would retrieve what you want, but I need to know a little more to offer any suggestions.

[Ayn]

Maybe use the search you currently have as a subsearch that feeds the time intervals of interest to an outer search.

[rhum_defintel]

How would I solve the summary problem?