How to limit result in PPL with "stats count() by field" to 10

OpenSearch
1

Opensearch 2.11.0

Helle there,

how could I limit with PPL the result of this statement:

source=dummyindey| stats count() by dummyfield

My goal is to get a Top-ten list with a count and name.
To visaluize it with a Pie-chart or others.

Thanks a lot.

regards
Juergen

2

You can use head to limit the results, | head 10.

3

That returns the first 10 lines, but unfortunately unsortet.
I need the ten lines with the highest “stats count() by dummyfield”

4

Sorting works with the dummfield:

This works:

source=dummyindex| stats count() by dummyfield | sort dummyfield | head 10

but this doesn’t:

source=dummyindex| stats count() by dummyfield | sort count() | head 10

Is there a way to use count() in the sort?

Thanks a lot.

5

I got it. Backticks are needed:

source = dummyindex | stats count() by dummyfield | sort - `count()` | head 10

Hope, it helps someone else : -)

Thanks.