You are on page 1of 1

DAy :2

Dedup for single filed or one can use it for multiple

ques-1:

why only 10000 stats are available post sort, find whhy and try to manipulate the
same like more than 10000
Ans: limit=0

ques-2:

Top 10 users who have consumed maximum bytes,

Ans:

index=dib_1 | stats sum(bytes) as total_bytes_Consumed by clientip | sort 10 -


total_bytes_Consumed | eval total_MBytes_Consumed=total_bytes_Consumed/(1024*1024)

You might also like