Base search AND "Return”="Finished” OR “body.message.Exit”=“Finished” “body.client.channel” IN (“CA”,“KY “,”NY “,”VA) | bin _time span=1s | stats count AS TP by _time,“body.client.channel” | sort -TPS
I am trying to get sort by Top 3 TP Count in Each state.
How can sort by ASC & different search in descending order by each state?
-time State TP
2019-06-04 19:38:35 CA 7
2019-06-04 19:40:50 CA 6
2019-06-04 19:40:50 CA 5
2019-06-04 19:40:50 CA 4
2019-06-04 19:30:47 KY 6
2019-06-04 19:31:24 KY 5
2019-06-04 19:31:24 KY 4
2019-06-04 19:31:24 KY 3
2019-06-04 19:31:27 NY 5
2019-06-04 19:31:27 NY 4
2019-06-04 19:31:27 NY 3
2019-06-04 19:31:27 NY 1
2019-06-04 19:33:27 VA 5
2019-06-04 19:38:47 VA 4
2019-06-04 19:38:47 VA 3
2019-06-04 19:38:47 VA 1
Hi @tej8,
Did you have a chance to check out any answers? If it worked, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help you.
Thanks for posting!
Hi @tej8,
<your query> | top 3 TP by State | sort +State -TP
I'm guessing you want to sort first with ascending order of State but within that, you want to sort descending order or TP.
Hope this helps!!!
@tej8,
Try
Your search
| sort -State,TP desc| dedup 3 State
OR
Your search
| sort -State,TP desc| streamstats count as _limit by State | where _limit <4
OR
your search
| top 3 TP by State|fields - count,percent