- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi ,
I have query which uses the chart command . Now i need only top ten values to be displayed for that query . used top but didnt get the proper results.
sourcetype="X" | eval a=mvfilter(eventtype LIKE "%_Metrics") |stats count by UniqueID,a |chart sum(count) by UniqueID,a | fillnull value="0"
here a contains the eventtypes
my results are something likethis..
UniqueId A_metrics B_metrics C_metrics
abc 0 56 0
sds 34 5 94
dss 0 53 39
ere 24 45 19
....
...
...
I need to display only the count top 10 UniqueId's..How can i do tat ?? Used top at the bottom but couldnt the same result as above..please help.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try adding this :
| addtotals | head 5| fields – Total
