Hey folks, I have data formatted as follows time fielda fieldb I want to find the top 3 values of fielda for each of fieldb, but for each result I need to know the time for which the top value occurred. I found I can use top to get the top 3 fielda by fieldb, yet time is stripped from the table: |top limit=3 fielda by fieldb Is there a way to use top to maintain that data, or perhaps an alternative command or set of commands I can use to get what I'm looking for? ... View more

They're quite huge (totalling over 70MB) and I've been looking into reducing our knowledge bundle size. From the app description the app's processing is performed on the search heads so I am guessing the files aren't needed on the indexers, so I'm wondering if it's ok to blacklist this app from being included in the knowledge bundle. ... View more