How can I search the 10 highest values per day?

[HeinzWaescher]

Hi,

I would like to find out the 10 highest values per day.

... | bucket span=1d 
| stats sum(xyz) AS values BY _time, user

I expected the | head command to work here, but this does not accept by _time.

BR Heinz

[pradeepkumarg · Accepted solution]

This should work

 ... | bucket span=1d 

 | stats sum(xyz) AS values BY _time, user | sort -_time -values | dedup 10 _time

[HeinzWaescher]

This works fine, thanks a lot!