topic Worst X in timechart in Splunk Search

Worst X in timechart

vbumgarner — Wed, 01 Dec 2010 08:17:21 GMT

When you have a timechart, by default you get the largest 10 values, then everything else bucketed into OTHER.

Can anyone think of an effective way to get the smallest 10 (or X) in a timechart?

What I have is KBps, and I want to find the values that have the worst performance over time.

Re: Worst X in timechart

bwooden — Wed, 01 Dec 2010 09:17:03 GMT

If you disable OTHER does that have the desired effect? Something like:

... | timechart useother=false limit=10 min(KBps) by host

Re: Worst X in timechart

vbumgarner — Wed, 01 Dec 2010 09:32:19 GMT

I believe that would show the 10 largest minimums.

I thought of a hacky double search way...

but I was hoping for something more elegant.

Re: Worst X in timechart

sideview — Fri, 06 May 2011 23:11:25 GMT

Sure. The answer to this question takes you back to the old clunky syntax for changing how many split-by values would be shown. The old syntax to change from 10 hosts to 50 hosts was:

<your search> | timechart count by host where sum in top50

and this was of course later streamlined to :

<your search> | timechart count by host limit=50

but the old verbose syntax still works, and indeed can can do "bottom50":

<your search> | timechart count by host where sum in bottom50