I have my search as below
index=xyz source=yhg | convert ctime(_time) as Date_and_Time|convert timeformat="%m/%d/%Y %H:%M:%S" mktime(_time) as time |eventstats range(time) as duration by student_id| stats avg(duration) as avgDurationPer_student_id by sudent_id | eval Total_time_spent(out_of_collage)=tostring(ceil(avgDurationPer_student_id), "duration") | table student_id Total_time_spent(out_of_collage)
The above search displays the result of the total time spent on the website by each student_id as below
student_id Total_time_spent(out_of_collage)
X123345 19:39:35
H900639 20:05:58
D900643 17:47:40
V106127 00:00:00
Now how can I modify above search and display the above table only for only top 5 student_id's instead of listing out all the student_id's based on the Total_time_spent(out_of_collage) which is hours:minutes:seconds format
Try sort command to arrange records in descending order of Total time spent and then use head command to get only 5
your base search | sort - Total_time_spent(out_of_collage) | head 5
Try sort command to arrange records in descending order of Total time spent and then use head command to get only 5
your base search | sort - Total_time_spent(out_of_collage) | head 5