Hi Team,
need your help
sourcetype=amc| search environment=* |top 5 showperc=f countfield="repeat_count" environment nodename
environment nodename repeat_count
DR Hostname1 636
Prod Hostname2 117
Prod Hostname3 108
Prod Hostname4 102
Prod Hostname5 87
who to get top 5 repeat_count host per environment [example show below]
environment nodename repeat_count
DR Hostname1 636
DR Hostname12 637
DR Hostname13 638
DR Hostname14 639
DR Hostname15 640
Prod Hostname21 117
Prod Hostname22 108
Prod Hostname23 102
Prod Hostname24 87
Prod Hostname25 86
This should do what you're looking for:
sourcetype=amc environment=*
| stats count AS repeat_count BY environment nodename
| sort 0 - environment repeat_count
| streamstats count AS top_count BY environment
| where top_count<=5
| fields environment nodename repeat_count
After generating the repeat_count
value, it sorts all the values within each environment
category by repeat_count
. It then uses streamstats to generate a top_count
value within each environment category. It filters out events with a top_count
value greater than 5 (preserving only the top 5), and then organizes the fields as you displayed them.
repeat_count is a field which has count of number of alerts