The interpretation is that per 3 hour bucket, you want to see the host source combination that had the most errors.
This is done with the last 3 lines that add a new field, "rank", and it's used to filter the result later.
earliest=-90d host=cswebprd1* sourcetype=psoft*
java.lang.OutOfMemoryError "Java heap space"
NOT date_wday=sunday NOT date_wday=saturday
date_hour>= 9 date_hour<= 17
| bucket _time span=3h
| eval hostsrc=host.sourcetype
| stats count as number_of_errors by _time, date_wday, hostsrc
| sort 0 _time, -number_of_errors
| streamstats count as rank by _time reset_on_change=true
| where rank <= 3
... View more