https://community.splunk.com/t5/Splunk-Search/timechart-sort-limiting-number-of-samples/m-p/20582#M3243 <P>First, you can simplify the timechart part by using per_second to sum the MB, and divide by 60, for example:</P> <PRE><CODE>index=performance network42 MBytes | timechart span=60s per_second(MBytes) as MBpersecond by guest usenull=f useother=f </CODE></PRE> <P>If you want to find the top ten spikes over a 60s period, you'd sort:</P> <PRE><CODE>index=performance network42 MBytes | timechart span=60s per_second(MBytes) as MBpersecond by guest usenull=f useother=f | sort 10 MBpersecond </CODE></PRE> <P>If you wanted to look for the busiest hosts, globally, you wouldn't use timechart at all:</P> <PRE><CODE>index=performance network42 MBytes | stats sum(MBytes) as MBtotal by guest | sort 10 MBtotal </CODE></PRE> Fri, 06 Apr 2012 03:14:08 GMT Stephen_Sorkin 2012-04-06T03:14:08Z https://community.splunk.com/t5/Splunk-Search/timechart-sort-limiting-number-of-samples/m-p/20581#M3242 <P>Trying to show the top 10 busiest guest VM's in mu environment.<BR /> Each guest VM is reporting its network status in the following syntax:</P> <PRE><CODE>Apr 5 13:41:22 a4-hpc1-2 logger: xen-performance network42 : timestamp=13:41:21 pool=General1 hardware=a4-hpc1-2 guest=9895_splatqa0006_RX interface=vif8.0 bytes=0133071 MBytes=0.12 </CODE></PRE> <P>Every 20 seconds I get a status update, and how much data was transmitted in the last 20sec. When I use the following search, I can get status of most VM's.</P> <PRE><CODE>index=performance network42 MBytes | eval MB = MBytes/20 | timechart max(MB) span=60s by guest usenull=f useother=f </CODE></PRE> <P>The problem comes in when I try to sort the data. </P> <PRE><CODE>index=performance network42 MBytes | eval MB = MBytes/20 | timechart max(MB) span=60s by guest usenull=f useother=f | sort num(MB) by guest limit=7 </CODE></PRE> <P>The limit on sort seems to be applying to the number of samples, not the number of guests.<BR /><BR /> Ideas?</P> Thu, 05 Apr 2012 21:30:58 GMT https://community.splunk.com/t5/Splunk-Search/timechart-sort-limiting-number-of-samples/m-p/20581#M3242 talbot7 2012-04-05T21:30:58Z https://community.splunk.com/t5/Splunk-Search/timechart-sort-limiting-number-of-samples/m-p/20582#M3243 <P>First, you can simplify the timechart part by using per_second to sum the MB, and divide by 60, for example:</P> <PRE><CODE>index=performance network42 MBytes | timechart span=60s per_second(MBytes) as MBpersecond by guest usenull=f useother=f </CODE></PRE> <P>If you want to find the top ten spikes over a 60s period, you'd sort:</P> <PRE><CODE>index=performance network42 MBytes | timechart span=60s per_second(MBytes) as MBpersecond by guest usenull=f useother=f | sort 10 MBpersecond </CODE></PRE> <P>If you wanted to look for the busiest hosts, globally, you wouldn't use timechart at all:</P> <PRE><CODE>index=performance network42 MBytes | stats sum(MBytes) as MBtotal by guest | sort 10 MBtotal </CODE></PRE> Fri, 06 Apr 2012 03:14:08 GMT https://community.splunk.com/t5/Splunk-Search/timechart-sort-limiting-number-of-samples/m-p/20582#M3243 Stephen_Sorkin 2012-04-06T03:14:08Z