topic Re: Why does limit=x on chart command doesn't work? in Splunk Search

Why does limit=x on chart command doesn't work?

morethanyell — Tue, 19 Jun 2018 01:57:50 GMT

this search string

    sourcetype=something
    | chart sum(views) as Views over Uploader limit=5
    | sort - Views

easily gives you the idea that what you're asking is "give me the top 5 most viewed video of the uploaders". But it doens't work. I fully understand now that you head to use the head command to trim the result to the top 5. But why? Working search string:

    sourcetype=something
    | chart sum(views) as Views over Uploader
    | sort - Views
    | head 5

Re: Why does limit=x on chart command doesn't work?

Ayn — Tue, 19 Jun 2018 06:41:08 GMT

limit is used for limiting how many columns the chart command should output when splitting by multiple fields, so if you do chart count by field1,field2 limit=5, that means Splunk will limit the field2 columns to 5. It doesn't take effect when splitting by only one field.

Also even if the limit argument would work like you had expected you would end up with undesired results in your first search. If you grab the first 5 results and THEN sort by Views, you'll likely not end up with the top 5 values as you didn't do the sorting until after you've limited the results.

Re: Why does limit=x on chart command doesn't work?

morethanyell — Tue, 19 Jun 2018 06:45:37 GMT

The training explained this but for some reason, I did not get it. It just clicked now. Thanks a lot, Ayn!

Re: Why does limit=x on chart command doesn't work?

surenderjat — Sun, 12 Jan 2020 03:44:23 GMT

Ayn answered the reason why limit doesn't work on chart.
For you to get the desired result you can do the following after your chart command line.
| sort 5 views