You need the top
command, like this:
... | top limit=3 count BY index
Or, to keep the country
field, this:
... | sort 0 - count | streamstats current=t count AS rank by index | where rank<4 | sort 0 index count
You need the top
command, like this:
... | top limit=3 count BY index
Or, to keep the country
field, this:
... | sort 0 - count | streamstats current=t count AS rank by index | where rank<4 | sort 0 index count
Thanks, the second one works!
Which one?
Thanks! the second one works perfectly!