Hi ,
I have a rsult set like this below
status URL value
status-500 identifiers 539
status-500 customer 529
status-400 dub 421
status-400 customer 413
status-500 eSIMEntitlement 387
status-400 identifiers 264
status-400 iot 193
status-400 token 157
status-500 msisdn 88
status-500 token 33
status-400 pushnotification 8
status-400 loyalty 3
status-500 iot 3
status-400 eSIMEntitlement 1
status-500 pushnotification 1
status-400 account 0
status-400 catalog 0
status-400 moat 0
status-400 msisdn 0
status-400 oauth2 0
what i need to do is top 5 URLs with status-400 and top 5 URLs with status-500 will be only remaining in the result set
is that possible?
| stats count by status URL| sort -count status| streamstats count as C by status| where C<=5
| stats count by status URL| sort -count status| streamstats count as C by status| where C<=5
Thanks @Vijeta Now i have acheieved upto this....i need to present this into buckets of status-400 and status-500
means on x-axis : bucket -400 , buckeyt-500 and on y axis url list
status URL-Bucket
status-400 account
status-400 catalog
status-400 customer
status-400 dub
status-400 eSIMEntitlement
status-500 account
status-500 catalog
status-500 customer
status-500 dub
status-500 eSIMEntitlement
i tried using thids
|stats values(URL) as URL-Bucket by status
its not working