https://community.splunk.com/t5/Splunk-Search/timechart-search-question/m-p/80623#M20365 <P>Use a subsearch to grab your top 5 hosts, then timechart based on those:</P> <PRE><CODE>... [search ... | stats sum(traffic) by host | sort - host | head 5 | fields host] | timechart sum(traffic) by sys_report_id,host </CODE></PRE> Fri, 05 Oct 2012 05:05:38 GMT Ayn 2012-10-05T05:05:38Z https://community.splunk.com/t5/Splunk-Search/timechart-search-question/m-p/80622#M20364 <P>Hi,</P> <P>My indexer receives the following network traffic stats in which value 3 and 4 of sys_report_id field indicates inbound and outbound traffic respectively.</P> <PRE><CODE>_time host sys_report_id traffic 1 10/4/12 9:48:59.000 PM host1.foo.com 4 503.283333 2 10/4/12 9:48:59.000 PM host1.foo.com 3 4103.533333 3 10/4/12 9:48:56.000 PM host2.foo.com 4 923.966102 4 10/4/12 9:48:56.000 PM host2.foo.com 3 4554.000000 5 10/4/12 9:48:55.000 PM host3.foo.com 4 4290.796296 6 10/4/12 9:48:55.000 PM host3.foo.com 3 6284.962963 7 10/4/12 9:48:01.000 PM host3.foo.com 4 4249.809524 8 10/4/12 9:48:01.000 PM host3.foo.com 3 4970.936508 .... </CODE></PRE> <P>How can I generate a timechart search to return inbound and outbound traffic stats for top 5 hosts that generate the most combined (inbound+outbound) traffic? i.e., I'm expecting this search shows 10 lines (5 pairs) with a line chart.</P> <P>Thanks in advance</P> Mon, 28 Sep 2020 12:34:06 GMT https://community.splunk.com/t5/Splunk-Search/timechart-search-question/m-p/80622#M20364 frank_zhang 2020-09-28T12:34:06Z https://community.splunk.com/t5/Splunk-Search/timechart-search-question/m-p/80623#M20365 <P>Use a subsearch to grab your top 5 hosts, then timechart based on those:</P> <PRE><CODE>... [search ... | stats sum(traffic) by host | sort - host | head 5 | fields host] | timechart sum(traffic) by sys_report_id,host </CODE></PRE> Fri, 05 Oct 2012 05:05:38 GMT https://community.splunk.com/t5/Splunk-Search/timechart-search-question/m-p/80623#M20365 Ayn 2012-10-05T05:05:38Z https://community.splunk.com/t5/Splunk-Search/timechart-search-question/m-p/80624#M20366 <P>Many thanks, Ayn. It solved my problems. Do you think there's any way to do this without having to use subsearch?</P> Fri, 05 Oct 2012 18:10:19 GMT https://community.splunk.com/t5/Splunk-Search/timechart-search-question/m-p/80624#M20366 frank_zhang 2012-10-05T18:10:19Z