I am attempting to get a listing of the max top 10 by a field.
I am able to get the the top 10 by doing this:
[search goes here] | top limit=10 message.facets.duration
I can get the max by doing:
[search goes here] | stats max(message.facets.duration)
I am trying to figure out how to get the max top 10.
↧