https://community.splunk.com/t5/Splunk-Search/Display-the-top-5-line-chart-field-values/m-p/478519#M134201 <PRE><CODE>|addtotals col=f row=t | sort - Total| head 5|fields - Total </CODE></PRE> Mon, 09 Sep 2019 18:21:27 GMT Sukisen1981 2019-09-09T18:21:27Z https://community.splunk.com/t5/Splunk-Search/Display-the-top-5-line-chart-field-values/m-p/478518#M134200 <P>I'm having some trouble with getting the top 5 line values on a line chart. My current search is below</P> <PRE><CODE>index=db sourcetype="dbmetrics" db_type IN (DB2, SQLSERVER) |eval db_inst=db_instance +" - " +application |eval db_app=database +" - " +application |eval db_info=coalesce(db_app, db_inst) |timechart span=1h eval(round(avg(db_connections),0)) as DB values(DB) by db_info useother=false limit=0 </CODE></PRE> <P>The problem is that when I add <CODE>where MAX in top5</CODE> I get the warning splunk Series filtering is disabled if a split-by field average. <BR /> Is there another way to get this to work? <BR /> Currently it looks like this but I want it to just show the top 5 lines.<BR /> <IMG src="https://community.splunk.com/storage/temp/275606-screen-shot-2019-09-09-at-125250-pm.png" alt="alt text" /></P> <P>Note: I have to take the average of db_connections due to certain db_instances having multiple events per hour</P> <P>Thanks for any help.</P> Wed, 30 Sep 2020 02:09:22 GMT https://community.splunk.com/t5/Splunk-Search/Display-the-top-5-line-chart-field-values/m-p/478518#M134200 mcg_connor 2020-09-30T02:09:22Z https://community.splunk.com/t5/Splunk-Search/Display-the-top-5-line-chart-field-values/m-p/478519#M134201 <PRE><CODE>|addtotals col=f row=t | sort - Total| head 5|fields - Total </CODE></PRE> Mon, 09 Sep 2019 18:21:27 GMT https://community.splunk.com/t5/Splunk-Search/Display-the-top-5-line-chart-field-values/m-p/478519#M134201 Sukisen1981 2019-09-09T18:21:27Z https://community.splunk.com/t5/Splunk-Search/Display-the-top-5-line-chart-field-values/m-p/478520#M134202 <P>Why can't you just use this?</P> <PRE><CODE>... |timechart span=1h eval(round(avg(db_connections),0)) as DB values(DB) by db_info useother=false limit=5 </CODE></PRE> Mon, 09 Sep 2019 21:47:59 GMT https://community.splunk.com/t5/Splunk-Search/Display-the-top-5-line-chart-field-values/m-p/478520#M134202 woodcock 2019-09-09T21:47:59Z