How to calculate Top limit=10 OR head 10 not working by Count?

[beriwalnishant]

Hi Team

I have a query where I am doing the TimeChart & % (not using the timechart and calculate the % in timechart line as this doesn't solve my purpose hence using it this say)

The query is working fine however it shows all the data on field and I want to have that field only show top 10  by volume or count

Query 

index=xyz (catcode="*") (prodid="1") (prodcat="*") success="*"
| bucket _time span="1d"

| eval TheError=if(success="false" AND Error_Value like "%%",count,0)
| eval Success=if(success="true",count,0)
| stats sum(TheError) as "Failed", sum(Success) as "Passed", sum(count) as Total by _time, catcode
| eval Failed_Percent=round((Failed/Total)*100,2)
| fields _time, catcode, Failed_Percent
| xyseries _time, catcode, Failed_Percent

I don't want to do the 'eventstats' because it will count all on prodid level and not at catcode level hence this query
This query counts all false with error on catcode....and count all attempts on individual catcode, then calculate the %
with event stats the total count will be not at catcode but all prodid count i.e. all catcode's total attempt's count

Thanks in advance

[ITWhisperer]

At this point in your search:

index=xyz (catcode="*") (prodid="1") (prodcat="*") success="*"
| bucket _time span="1d"

| eval TheError=if(success="false" AND Error_Value like "%%",count,0)
| eval Success=if(success="true",count,0)
| stats sum(TheError) as "Failed", sum(Success) as "Passed", sum(count) as Total by _time, catcode

you have 5 fields, _time, catcode, Failed, Passed and Total.

Where does prodId come from?

If you use eventstats at this point, you can sum the Total to find count all the events by catcode.

index=xyz (catcode="*") (prodid="1") (prodcat="*") success="*"
| bucket _time span="1d"

| eval TheError=if(success="false" AND Error_Value like "%%",count,0)
| eval Success=if(success="true",count,0)
| stats sum(TheError) as "Failed", sum(Success) as "Passed", sum(count) as Total by _time, catcode
| eventstats sum(Total) as Total_catcode by catcode

Does that help you? If not, please explain with some examples of what you are currently have and what you would like to see

[richgalloway · Accepted solution]

To show only the 10 results with the highest values of Failed_Percent you can use the sort command.

...
| xyseries _time, catcode, Failed_Percent
| sort 10 - Failed_Percent

[beriwalnishant]

This only sorts the time and instead of 10 showing single column of catcode...the one is hihest