2 files changed, 71 insertions, 0 deletions
diff --git a/internal/statsengine/snapshot.go b/internal/statsengine/snapshot.go
index 6e38739..1cc2118 100644
--- a/internal/statsengine/snapshot.go
+++ b/internal/statsengine/snapshot.go
@@ -183,6 +183,12 @@ func (s Snapshot) SyscallsCount() int {
 	return len(s.syscalls)
 }
 
+// TopNSyscalls returns at most n per-syscall rows in ranking order.
+// Callers must treat returned data as read-only.
+func (s Snapshot) TopNSyscalls(n int) []SyscallSnapshot {
+	return topNSyscalls(s.syscalls, n)
+}
+
 // Files returns per-file snapshot rows.
 // Callers must treat returned data as read-only.
 func (s Snapshot) Files() []FileSnapshot {
@@ -194,6 +200,12 @@ func (s Snapshot) FilesCount() int {
 	return len(s.files)
 }
 
+// TopNFiles returns at most n file rows in ranking order.
+// Callers must treat returned data as read-only.
+func (s Snapshot) TopNFiles(n int) []FileSnapshot {
+	return topNFiles(s.files, n)
+}
+
 // Processes returns per-process snapshot rows.
 // Callers must treat returned data as read-only.
 func (s Snapshot) Processes() []ProcessSnapshot {
@@ -205,8 +217,44 @@ func (s Snapshot) ProcessesCount() int {
 	return len(s.processes)
 }
 
+// TopNProcesses returns at most n process rows in ranking order.
+// Callers must treat returned data as read-only.
+func (s Snapshot) TopNProcesses(n int) []ProcessSnapshot {
+	return topNProcesses(s.processes, n)
+}
+
 // Buckets returns histogram buckets.
 // Callers must treat returned data as read-only.
 func (h HistogramSnapshot) Buckets() []HistogramBucketSnapshot {
 	return h.buckets
 }
+
+func topNSyscalls(rows []SyscallSnapshot, n int) []SyscallSnapshot {
+	if n <= 0 || len(rows) == 0 {
+		return nil
+	}
+	if n > len(rows) {
+		n = len(rows)
+	}
+	return rows[:n:n]
+}
+
+func topNFiles(rows []FileSnapshot, n int) []FileSnapshot {
+	if n <= 0 || len(rows) == 0 {
+		return nil
+	}
+	if n > len(rows) {
+		n = len(rows)
+	}
+	return rows[:n:n]
+}
+
+func topNProcesses(rows []ProcessSnapshot, n int) []ProcessSnapshot {
+	if n <= 0 || len(rows) == 0 {
+		return nil
+	}
+	if n > len(rows) {
+		n = len(rows)
+	}
+	return rows[:n:n]
+}
diff --git a/internal/statsengine/snapshot_test.go b/internal/statsengine/snapshot_test.go
index e5c3caa..277fa0d 100644
--- a/internal/statsengine/snapshot_test.go
+++ b/internal/statsengine/snapshot_test.go
@@ -103,3 +103,26 @@ func TestNilAccessorsRemainNil(t *testing.T) {
 		t.Fatalf("expected nil buckets, got %#v", got)
 	}
 }
+
+func TestTopNAccessors(t *testing.T) {
+	s := NewSnapshot(
+		nil,
+		nil,
+		nil,
+		[]SyscallSnapshot{{Name: "a"}, {Name: "b"}, {Name: "c"}},
+		[]FileSnapshot{{Path: "/a"}, {Path: "/b"}},
+		[]ProcessSnapshot{{PID: 1}, {PID: 2}, {PID: 3}},
+		HistogramSnapshot{},
+		HistogramSnapshot{},
+	)
+
+	if got := s.TopNSyscalls(2); len(got) != 2 {
+		t.Fatalf("expected 2 top syscalls, got %d", len(got))
+	}
+	if got := s.TopNFiles(10); len(got) != 2 {
+		t.Fatalf("expected all files when n exceeds len, got %d", len(got))
+	}
+	if got := s.TopNProcesses(0); got != nil {
+		t.Fatalf("expected nil when n<=0, got %#v", got)
+	}
+}