limiting column or cell results

[dhammad]

Hello All - I have the following search query with following search results below. What I like to do is to limit the Destinations to about 5 or 10. Currently with popular categories - I get double digit Destinations. Thanks for the help.

Query:

index=summary earliest="-1d@d" latest="-1d@d+1h" | fields category, total_bytes, cs_uri_authority | eval domain=lower(cs_uri_authority) | stats sum(eval(round(total_bytes/1024/1024,2))) as b by category, domain | sort -b | stats sum(b) as CategoryMBytes, list(domain) as Destinations, list(b) as DestinationMBytes by category | eventstats sum(CategoryMBytes) as TotalMBytes | eval PercentOfTotal = 100 * CategoryMBytes / TotalMBytes . "%" | sort -CategoryMBytes | rename category as Category | table Category, CategoryMBytes, PercentOfTotal, Destinations, DestinationMBytes | head 10

Result:

Category            CategoryMBytes     PercentOfTotal    Destinations       DestinationMBytes
-----------------------------------------------------------------------------------------------
Audio/Video Clips    500               26.005%           ytimg.com          300
                                                         youtube.com        82.09
                                                         go.com             10
                                                         123.com            10
                                                         blahblah.com       10
                                                         wjla.com           10
                                                           ....
    

News/Media           473               22.5%             nytimes.com        34.18
                                                         washingtonpost.com 10

[somesoni2]

You can use following after your search query.

index=summary earliest="-1d@d" latest="-1d@d+1h" | fields category, total_bytes, cs_uri_authority | eval domain=lower(cs_uri_authority) | stats sum(eval(round(total_bytes/1024/1024,2))) as b by category, domain | sort -b | stats sum(b) as CategoryMBytes, list(domain) as Destinations, list(b) as DestinationMBytes by category | eventstats sum(CategoryMBytes) as TotalMBytes | eval PercentOfTotal = 100 * CategoryMBytes / TotalMBytes . "%" | sort -CategoryMBytes | rename category as Category | table Category, CategoryMBytes, PercentOfTotal, Destinations, DestinationMBytes | head 10

| eval Destinations=mvindex(Destinations,0,10)| eval DestinationMBytes =mvindex(DestinationMBytes ,0,10)

Just to tell you, it will not affect values in other columns, it will just truncate the values shown on the Destinations and DestinationMBytes. Hope this helps.

[dhammad]

Thank you very much - That does the trick.