https://community.splunk.com/t5/Splunk-Search/How-to-Get-required-top-users-where-I-am-sorting-timechart-by/m-p/88788#M22725 <P>I am showing a timechart by users. I want to show top 10 users on the graph having some particular condition. How to achieve that?? </P> Tue, 26 Apr 2011 08:53:50 GMT tkadale 2011-04-26T08:53:50Z https://community.splunk.com/t5/Splunk-Search/How-to-Get-required-top-users-where-I-am-sorting-timechart-by/m-p/88788#M22725 <P>I am showing a timechart by users. I want to show top 10 users on the graph having some particular condition. How to achieve that?? </P> Tue, 26 Apr 2011 08:53:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-Get-required-top-users-where-I-am-sorting-timechart-by/m-p/88788#M22725 tkadale 2011-04-26T08:53:50Z https://community.splunk.com/t5/Splunk-Search/How-to-Get-required-top-users-where-I-am-sorting-timechart-by/m-p/88789#M22726 <P>Hi, </P> <P>i think head will resolve your question : <A href="http://www.splunk.com/base/Documentation/latest/SearchReference/Head">http://www.splunk.com/base/Documentation/latest/SearchReference/Head</A></P> <P>mysearchquery | head 10 </P> <P>christian </P> Tue, 26 Apr 2011 14:31:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-Get-required-top-users-where-I-am-sorting-timechart-by/m-p/88789#M22726 Christian 2011-04-26T14:31:22Z https://community.splunk.com/t5/Splunk-Search/How-to-Get-required-top-users-where-I-am-sorting-timechart-by/m-p/88790#M22727 <P>Well what's your particular condition? </P> <P>The idea is to use the search language before the timechart clause, to filter the set of users down to whatever it is you want, and then pipe those filtered results to <CODE>timechart count by user</CODE>. You might use searchterms using the =, &lt; or &gt; operators, you might have a parenthetic clause like <CODE>(foo OR bar OR baz)</CODE>, or some NOT terms like <CODE>NOT status=304</CODE>, you can pipe to the <CODE>eval</CODE> or <CODE>rex</CODE> commands to do fancier things, then you filter again with another <CODE>search</CODE> clause or a <CODE>where</CODE> clause, etc. The sky's the limit. </P> Tue, 26 Apr 2011 16:35:47 GMT https://community.splunk.com/t5/Splunk-Search/How-to-Get-required-top-users-where-I-am-sorting-timechart-by/m-p/88790#M22727 sideview 2011-04-26T16:35:47Z https://community.splunk.com/t5/Splunk-Search/How-to-Get-required-top-users-where-I-am-sorting-timechart-by/m-p/88791#M22728 <P>Just to chime in with the others, I do something akin to what you do with the following:</P> <PRE> &lt;various search commands&gt; | stats count by Username | sort limit=10 -count </PRE> <P>I have a field which is recognised as Username and have found this gets me the result I want best. Not quite a timechart, but, easy enough to modify to get that.</P> Tue, 26 Apr 2011 21:17:34 GMT https://community.splunk.com/t5/Splunk-Search/How-to-Get-required-top-users-where-I-am-sorting-timechart-by/m-p/88791#M22728 howyagoin 2011-04-26T21:17:34Z https://community.splunk.com/t5/Splunk-Search/How-to-Get-required-top-users-where-I-am-sorting-timechart-by/m-p/88792#M22729 <P>just to make this all complete watch also for the top command (<A href="http://www.splunk.com/base/Documentation/latest/SearchReference/top">http://www.splunk.com/base/Documentation/latest/SearchReference/top</A>)</P> Wed, 27 Apr 2011 08:13:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-Get-required-top-users-where-I-am-sorting-timechart-by/m-p/88792#M22729 Christian 2011-04-27T08:13:39Z