Base search AND "Return”="Finished” OR “body.message.Exit”=“Finished” “body.client.channel” IN (“CA”,“KY “,”NY “,”VA) | bin _time span=1s | stats count AS TP by _time,“body.client.channel” | sort -TPS
I am trying to get sort by Top 3 TP Count in Each state.
How can sort by ASC & different search in descending order by each state?
-time State TP
2019-06-04 19:38:35 CA 7
2019-06-04 19:40:50 CA 6
2019-06-04 19:40:50 CA 5
2019-06-04 19:40:50 CA 4
2019-06-04 19:30:47 KY 6
2019-06-04 19:31:24 KY 5
2019-06-04 19:31:24 KY 4
2019-06-04 19:31:24 KY 3
2019-06-04 19:31:27 NY 5
2019-06-04 19:31:27 NY 4
2019-06-04 19:31:27 NY 3
2019-06-04 19:31:27 NY 1
2019-06-04 19:33:27 VA 5
2019-06-04 19:38:47 VA 4
2019-06-04 19:38:47 VA 3
2019-06-04 19:38:47 VA 1
... View more