I want top 10 values for a field based on the timer control.
mysearch | top 10 E_Time
above command return top 10 results based on the events count. is there anyway to return top 10 values and display a graph based on these values?
alternatively I can run this search and display the graph
mysearch | table time ETIME | sort -ETIME | head 10 | where len(ETIME) > 0
... | head 10
head will not necessarily return the latest results. The
head command will retrieve the first X items from what it's given in the search pipeline. If it's run directly after the initial
search command, then you are right, what comes in the search pipeline will be the latest events. If you run it after
table though, for instance, it will get the table items and give you the first X of those. So, if you have a table with data that is sorted in the way you want, running
head 10 will give you the first 10 items according to that sort order. I believe that's what you wanted.
Thanks Ayn, yep you are right I used | head x to get the result. I solved my problem with table | sort | head
buy my question, is it possible to get top 10 E_Time values [not events] using top command?