topic Re: Quick Question: Charting maximum values in Splunk Search

Quick Question: Charting maximum values

wyang6 — Mon, 18 Apr 2011 20:53:30 GMT

<option name="charting.data.count">3</option>

<option name="charting.chart">bar</option>

The lines above graphs a bar chart with values from the first 3 rows. How can I instead graph the highest 3 values? In addition, how can I scale the axis such that it is normalized with respect to the maximum value?

Thank you.

Re: Quick Question: Charting maximum values

hazekamp — Mon, 18 Apr 2011 21:07:48 GMT

To graph the 3 highest values you can limit your search results to the 3 highest values. Depending on your search limits can be done in a few different methods.

For a single count field (i.e. when using stats):

| top limit=3 foo
| stats count by foo | sort 3 - <count_field>

For mult-dimensional count fieds (i.e. when using chart):

| addtotals | sort 3 - Total

For first 'n' results:

| head 3

Re: Quick Question: Charting maximum values

wyang6 — Mon, 18 Apr 2011 21:34:32 GMT

Thanks. If I also want a table with all the rows displayed, how can I get around

top limit=n
OR
head n

Re: Quick Question: Charting maximum values

hazekamp — Mon, 18 Apr 2011 22:16:14 GMT

For the search, you can do "| top limit=0". On the dashboard side, if you are using simple XML try the showPager option.