https://community.splunk.com/t5/Splunk-Search/timechart-limit-pick-top-10-series-with-the-highest-peaks-of-all/m-p/467307#M131508 <PRE><CODE>... | timechart useother=f span=5m count by client_ip where sum in top10 </CODE></PRE> <P>try <CODE>where</CODE> clause.</P> Mon, 06 Apr 2020 20:21:29 GMT to4kawa 2020-04-06T20:21:29Z https://community.splunk.com/t5/Splunk-Search/timechart-limit-pick-top-10-series-with-the-highest-peaks-of-all/m-p/467306#M131507 <P>I'm looking to investigate IP addresses with highest peak loads on our service. Here's my current query:</P> <PRE><CODE>application="my-app" index="my-index" request client_ip="*" user_agent="*" request="*" kube_pod="web-*" | timechart limit=10 useother=f span="5minute" count by client_ip </CODE></PRE> <P>It works, and it's <EM>almost</EM> what I'm looking for. The documentation states:</P> <BLOCKQUOTE> <P>If a single aggregation is specified, the score is based on the sum of the values in the aggregation for that split-by value. For example, for <CODE>timechart avg(foo) BY &lt;field&gt;</CODE> the <CODE>avg(foo)</CODE> values are added up for each value of to determine the scores.</P> </BLOCKQUOTE> <P>If I understand this correctly, <CODE>timeseries</CODE> is picking the top <CODE>10</CODE> series whose sum of <CODE>count</CODE>s over the time span are the greatest. That is to say, it's picking the <CODE>10</CODE> top series by greatest integral.</P> <P>Instead, I want to select the <CODE>10</CODE> top series with the highest peak values (of any time in the timespan). For example, if there's a single data point that shows 10,000 requests per second for a single second, I want to be chosen over another series that shows 10 requests/second for months straight (whose integral would be much greater, but with a much lower max peak).</P> <P>Could you please help me do that?</P> Mon, 06 Apr 2020 16:18:14 GMT https://community.splunk.com/t5/Splunk-Search/timechart-limit-pick-top-10-series-with-the-highest-peaks-of-all/m-p/467306#M131507 amomchilov 2020-04-06T16:18:14Z https://community.splunk.com/t5/Splunk-Search/timechart-limit-pick-top-10-series-with-the-highest-peaks-of-all/m-p/467307#M131508 <PRE><CODE>... | timechart useother=f span=5m count by client_ip where sum in top10 </CODE></PRE> <P>try <CODE>where</CODE> clause.</P> Mon, 06 Apr 2020 20:21:29 GMT https://community.splunk.com/t5/Splunk-Search/timechart-limit-pick-top-10-series-with-the-highest-peaks-of-all/m-p/467307#M131508 to4kawa 2020-04-06T20:21:29Z https://community.splunk.com/t5/Splunk-Search/timechart-limit-pick-top-10-series-with-the-highest-peaks-of-all/m-p/467308#M131509 <P>Ah, I hadn't looked at that. From the docs it seems promising:</P> <BLOCKQUOTE> <P>Specifies the criteria for including particular data series when a field is given in the . The most common use of this option is to look for spikes in your data rather than overall mass of distribution in series selection. The default value finds the top ten series by area under the curve. Alternately one could replace sum with max to find the series with the ten highest spikes. Essentially the default is the same as specifying where sum in top10. The has no relation to the where command.</P> </BLOCKQUOTE> <P>I'll give it a shot and report back. How do <CODE>where</CODE> and <CODE>limit</CODE> interact?</P> Mon, 06 Apr 2020 20:45:27 GMT https://community.splunk.com/t5/Splunk-Search/timechart-limit-pick-top-10-series-with-the-highest-peaks-of-all/m-p/467308#M131509 amomchilov 2020-04-06T20:45:27Z https://community.splunk.com/t5/Splunk-Search/timechart-limit-pick-top-10-series-with-the-highest-peaks-of-all/m-p/467309#M131510 <P>Woo, that worked great!</P> Mon, 06 Apr 2020 21:05:06 GMT https://community.splunk.com/t5/Splunk-Search/timechart-limit-pick-top-10-series-with-the-highest-peaks-of-all/m-p/467309#M131510 amomchilov 2020-04-06T21:05:06Z https://community.splunk.com/t5/Splunk-Search/timechart-limit-pick-top-10-series-with-the-highest-peaks-of-all/m-p/467310#M131511 <P><CODE>.... where max in top10</CODE><BR /> It was this.<BR /> <CODE>limit</CODE>handle the count of result.<BR /> <CODE>where</CODE> handle the result.<BR /> I think so.</P> Mon, 06 Apr 2020 21:10:59 GMT https://community.splunk.com/t5/Splunk-Search/timechart-limit-pick-top-10-series-with-the-highest-peaks-of-all/m-p/467310#M131511 to4kawa 2020-04-06T21:10:59Z