I'm charting multiseries data displayed in stacked columns with the following command:
stats dc(ProcessName) by
hostname,Company | xyseries
This works fine, except for the fact that I now have over 5000 hosts (i.e. values for 'hostname') and I need a way to quickly display only the ones with the most number of processes (i.e. discrete values of 'Process_Name'). If I could make it work, something like 'top' or 'head' would be great:
stats dc(Process_Name) as processes by
The sort command seems to provide unpredictable results though when it is preceded by a multi-value command (e.g. the B,C in 'stats(A) by B,C'). Can anyone offer me a way to view just the top 50 (or whatever) hosts when sorted by the number of processes?
Thanks for the help.
your base search | stats dc(Process_Name) by hostname,Company | sort hostname,-dc(Process_Name) | streamstats count by hostname | where count < 51 |xyseries hostname,Company,processes
Thanks for your suggestion. It gave me a number of things to try out and poke at, none of which worked unfortunately.
As far as I can tell, after I call "stats dc(Process_Name) by hostname,Company", everything has already been sorted by hostname and other attempts to reorder the data yield strange results. For instance, this:
base search | stats dc(Process_Name) by hostname,Company | sort -hostname | xyseries hostname,Company,dc(Process_Name)
gives sorts the hosts starting at 328 and goes up from there instead of starting at 1.
Streamstats seemed to have no effect at all. Other ideas?