Hello, let's see if someone can help with this 🙂
I have 4 fields, 3 which I would like to have sorted and counted in relation to the first one, and then display the top 3 for each.
For example, I have the fields:
category
subcategory
product_id
referrer_url
And I want to display the top 20 categories, and for each category, the top 3 subcategories, top 3 product_id and top 3 referrer_url (each with its counter).
So far I've come with this, which is close, but I still have to figure out how to sort and count 3 of the columns.
<my_search>
| table category subcategory product_id referrer_url
| stats count(category) AS Count list(subcategory) AS SubCat list(product_id) as PID list(referrer_url) as URL by category
| sort - Count
|head 20
|eval SubCat=mvindex(SubCat, 0, 2) | eval PID=mvindex(PID, 0, 2)| eval URL=mvindex(URL, 0, 2)
That's close, but I want SubCat , PID and URL sorted and counted ( top would do it, but seems cannot be inserted into a stats search)
The expected output would be something like this:
(statistics view)
So 20 categories, then for each the top 3 for each column, with its count.
Thanks!
... View more
