Ohhhh, you really meant creating rank as a variable and using that. This is working like a charm! You are a rockstar and have helped me better understand bin and TIL streamstats. Thank you very much PickleRick. ... View more

Is there a way to only display the top 10 results from each bin? With my dataset, there are so many different x_forwarded_for that there are 100 pages (max return) with 100 x_forwarded_for ips per page for just the first bin in the lookback window. ... View more

@PickleRick wrote: Hmm. That should have given you top values for every bin. At least that's how I understood your specs. Drop the last stats and see what you get. You should get a table of counted x_forwarded_for values sorted by count, groupped by time (divided into 5-minute bins)   x_forwarded_for _time count x.x.x.1 2022-02-10 13:20:00 191 x.x.x.2 2022-02-10 13:20:00 77 x.x.x.3 2022-02-10 13:20:00 66 every ip in the table is in the same 13:20:00 _time bin when I remove the last stat. One thing that might be interesting to note, when I do execute the query with stats first(*) by _time, halfway through the execution, it seems like there's a chart with a row for every bin with an x_forwarded_for value and count associated with that _time bin. By the end of the execution, that list is compressed to a single row. ... View more

If you want more than one "top" result, instead of stats first you'd need to do streamstats count to add rank order and do a where to limit results by this rank value. Should I interpret this as in more than one "top" result across the first bin or across all bins? The query you provided almost  gets me there. I was hoping it would get the top value across all bins. This seems to just return the highest count value for the first bin. ... View more