Hi there, I am not sure if I am missing out the obvious but I would pretty much like to be able to run stats count of a certain field and get highest10 results of that field and then be able to see other data specifically related to that 10 results. To be more specific, I would like to see a list of fieldA by count and with highest value something similar to this index=mysearch | stats count by fieldA | sort count - | head 10 but I would als like to be able to see fieldB values that are related to those ten results however if I run index=mysearch | stats count by fieldA,fieldB | sort count - | head 10 then the results for the FieldA are not the same as in the previous query Just to sum it up, I would like to see the fieldB values that are related to the head 10 results of fieldA but I am not interested in seeing the stats count of both fieldA and fieldB together. I really hope this makes sense. Thank you in advance for your help!
... View more