I am trying to write a search for getting the top two failed policy count for each cycledate. The below works for a single day but not for multiple cycledates. index=xxx host=yy* source="*E:\\logfile\*" tag="*error*" "Error ==>*" | stats distinct_count(polnum) as FailedPolicy by error_message, err_code, cycledate | sort 2-FailedPolicy   Table without the sort 2 -FailedPolicy error_ message err_Code CycleDate FailedPolicy Err1 20167 09112020 35 Err2 23461 09112020 12 Err3 23451 09112020 22 Err4 1324 09112020 3 Err5 134155 09102020 21 Err6 3245 09102020 81 Err7 1234 09102020 2 Err8 4124 09092020 21 Err9 567 09092020 31 Err10 9873 09092020 45 ... View more