https://community.splunk.com/t5/Splunk-Search/timechart-but-only-for-the-top-5/m-p/81263#M20559 <P>I'm going to try this to see how it comes out</P> Wed, 29 Feb 2012 00:38:52 GMT hartfoml 2012-02-29T00:38:52Z https://community.splunk.com/t5/Splunk-Search/timechart-but-only-for-the-top-5/m-p/81257#M20553 <P>I want to use timechart to show a graph of the progress of an item so I use this command</P> <PRE><CODE>| timechart span=1w count by plugin </CODE></PRE> <P>the problem is I have too many plugins. I want to limit the chart to only the top 5 plugin's over the time period</P> <P>So something like this but this dosn't work</P> <PRE><CODE>| timecart span=1w top 5 plugin </CODE></PRE> <P>Anyone know how to use top with timechart ??</P> Tue, 28 Feb 2012 23:45:02 GMT https://community.splunk.com/t5/Splunk-Search/timechart-but-only-for-the-top-5/m-p/81257#M20553 hartfoml 2012-02-28T23:45:02Z https://community.splunk.com/t5/Splunk-Search/timechart-but-only-for-the-top-5/m-p/81258#M20554 <P>OK so i found out that LIMIT reduces to the top "n" number of items like this</P> <PRE><CODE> | timechart span=1w limit=5 count by plugin </CODE></PRE> <P>this gives me the top 5 but puts in the other field with all the ones not in the top 5.</P> <P>Anyone know how to not show other in the chart???</P> Wed, 29 Feb 2012 00:23:23 GMT https://community.splunk.com/t5/Splunk-Search/timechart-but-only-for-the-top-5/m-p/81258#M20554 hartfoml 2012-02-29T00:23:23Z https://community.splunk.com/t5/Splunk-Search/timechart-but-only-for-the-top-5/m-p/81259#M20555 <P>You could try to use subsearch:</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/User/HowSubsearchesWork">http://docs.splunk.com/Documentation/Splunk/latest/User/HowSubsearchesWork</A></P> <P>Something like this:</P> <P>index=* [search index=* | stats count by plugin | sort - count | head 5 | fields + plugin] | timechart span=1w count by plugin</P> Wed, 29 Feb 2012 00:33:22 GMT https://community.splunk.com/t5/Splunk-Search/timechart-but-only-for-the-top-5/m-p/81259#M20555 imrago 2012-02-29T00:33:22Z https://community.splunk.com/t5/Splunk-Search/timechart-but-only-for-the-top-5/m-p/81260#M20556 <PRE><CODE>| timecart span=1w limit=5 useother=f count by plugin </CODE></PRE> Wed, 29 Feb 2012 00:37:27 GMT https://community.splunk.com/t5/Splunk-Search/timechart-but-only-for-the-top-5/m-p/81260#M20556 gkanapathy 2012-02-29T00:37:27Z https://community.splunk.com/t5/Splunk-Search/timechart-but-only-for-the-top-5/m-p/81261#M20557 <P>I got it thanks the right syntax to use for this is</P> <PRE><CODE>| timechart useother=F span=1w limit=5 count by plugin </CODE></PRE> <P>this says to useother=false so that other is not on the chart and the limit is 5</P> Wed, 29 Feb 2012 00:37:53 GMT https://community.splunk.com/t5/Splunk-Search/timechart-but-only-for-the-top-5/m-p/81261#M20557 hartfoml 2012-02-29T00:37:53Z https://community.splunk.com/t5/Splunk-Search/timechart-but-only-for-the-top-5/m-p/81262#M20558 <P>thanks you beet me to it</P> Wed, 29 Feb 2012 00:38:32 GMT https://community.splunk.com/t5/Splunk-Search/timechart-but-only-for-the-top-5/m-p/81262#M20558 hartfoml 2012-02-29T00:38:32Z https://community.splunk.com/t5/Splunk-Search/timechart-but-only-for-the-top-5/m-p/81263#M20559 <P>I'm going to try this to see how it comes out</P> Wed, 29 Feb 2012 00:38:52 GMT https://community.splunk.com/t5/Splunk-Search/timechart-but-only-for-the-top-5/m-p/81263#M20559 hartfoml 2012-02-29T00:38:52Z https://community.splunk.com/t5/Splunk-Search/timechart-but-only-for-the-top-5/m-p/81264#M20560 <P>would limit=5 show you the top 5 "plugin" or only limit it to some random 5 "plugins"? as in, would it show you the highest 5 counts of a "plugin"?</P> Tue, 19 Jan 2016 19:00:20 GMT https://community.splunk.com/t5/Splunk-Search/timechart-but-only-for-the-top-5/m-p/81264#M20560 sbattista09 2016-01-19T19:00:20Z https://community.splunk.com/t5/Splunk-Search/timechart-but-only-for-the-top-5/m-p/81265#M20561 <P>useother=f</P> Thu, 11 May 2017 16:45:25 GMT https://community.splunk.com/t5/Splunk-Search/timechart-but-only-for-the-top-5/m-p/81265#M20561 jtrimmings 2017-05-11T16:45:25Z https://community.splunk.com/t5/Splunk-Search/timechart-but-only-for-the-top-5/m-p/81266#M20562 <P>This does not seem to chart the top list, but a random list of 5. They are not the "top 5" in count, and not in order by count. How do we do that?</P> Fri, 04 Aug 2017 14:19:46 GMT https://community.splunk.com/t5/Splunk-Search/timechart-but-only-for-the-top-5/m-p/81266#M20562 kbrown9392 2017-08-04T14:19:46Z https://community.splunk.com/t5/Splunk-Search/timechart-but-only-for-the-top-5/m-p/745309#M241405 <P>I know this is a pretty old post, but wanted to put this here for anyone else looking.&nbsp; This has bothered me for some time.&nbsp;&nbsp;</P><P>It seems timechart, as of some version, supports 3 limit options:</P><P>limit=N</P><P>limit=topN</P><P>limit=bottomN</P><P><A href="https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Timechart" target="_blank">https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Timechart</A></P> Thu, 01 May 2025 13:45:14 GMT https://community.splunk.com/t5/Splunk-Search/timechart-but-only-for-the-top-5/m-p/745309#M241405 msquicc 2025-05-01T13:45:14Z https://community.splunk.com/t5/Splunk-Search/timechart-but-only-for-the-top-5/m-p/745315#M241408 <P>limit=N is the same as limit=topN</P><P>And the bottomN appeared in 8.1, which was several years ago <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Thu, 01 May 2025 16:28:37 GMT https://community.splunk.com/t5/Splunk-Search/timechart-but-only-for-the-top-5/m-p/745315#M241408 PickleRick 2025-05-01T16:28:37Z