stats, limiting to top results, and summarizing the rest

[jeff]

I am trying to produce a table for a dashboard that will summarize the top results of the search, but summarize the remaining data in an "other" row. I have the following search which is working, but thinking there should be a cleaner / more efficient way to do it:

my_search_criteria index=summary_data search_name="per_source_summary"
| stats count as hosts sum(score) avg(score) sum(one) sum(two) sum(three) sum(four) by group 
| sort limit=10 sum(score) desc
| append
  [ search my_search_criteria index=summary_data search_name="per_source_summary" NOT 
    [ search my_search_criteria index=summary_data search_name="per_source_summary"
      | stats count as hosts sum(score) avg(score) sum(one) sum(two) sum(three)
        sum(four) by group 
      | sort limit=10 sum(score) desc
      |fields group ]
  | stats count as hosts sum(score) avg(score) sum(one) sum(two) sum(three) sum(four)  
  | eval group="Other" ]
| addtotals col=t row=f labelfield=group label="Overall" hosts sum(score) 
  sum(one) sum(two) sum(three) sum(four)

This simplified example looks a lot cleaner than my actual search of course. It's using summary data so the search itself isn't taking terribly long or too resource intensive, but is there a "better" way of doing this I'm missing?

[Ayn]

Couldn't you just use chart instead? You can tell it to limit unique series using the limit parameter. So for instance setting limit=10 and useother=t will cause chart to print out the top 10 unique results, then add an "OTHER" field for the rest.

my_search_criteria index=summary_data search_name="per_source_summary"
| chart limit=10 useother=t count as hosts sum(score) avg(score) sum(one) sum(two) sum(three) sum(four) by group

[jeff]

I don't have a lot of experience with chart, but it doesn't seem so- limit doesn't restrict the number of rows returned but the number of splits per row, requires a split-by clause, AND does not work with multiple data series... so I could do something like:

| chart limit=10 useother=t count as hosts by group subgroup

which would return all rows from the search (by group), with the counts per split (subgroup) for each row, up to the limit, plus the "other" column. Thanks for the lead though- may play around with chart for some other stuff I'm looking at.