Hello,
I am trying to do a search to have a table display each country, and then from that, show the top three Services Ran. I am stumped with how to limit the ServiceRan column to only show the top three for each country without messing it up.
sourcetype= action=X| transaction country| table country,serviceRan
Currently with this search it outputs a table and displays two columns one being the country with one value, and another being the serviceRan with anywhere from 1 to 10 values for each country. Again, I would like to limit the serviceRan to only showing the top 3 results for that particular country.
↧