https://community.splunk.com/t5/Splunk-Search/How-to-graph-timechart-of-top-5-processes-for-the-metric/m-p/197561#M57086 <P>Hi All. If the user selects %_Processor_Time,then I need to show the graph for avg(%_Processor_Time) for top 5 processes that consumes %_Processor_Time. I got the top 5 processes using the search but unable to write the timechart command in the same query to display graph.</P> <P>index=winserver_process sourcetype="PerfmonMk:Process" NOT instance=Idle NOT instance=_Total host="ddweng09" | eval Process=upper(instance) | table Process %_Processor_Time | sort - %_Processor_Time | dedup Process | head 5</P> Mon, 28 Sep 2020 17:25:56 GMT vaishnavi07 2020-09-28T17:25:56Z https://community.splunk.com/t5/Splunk-Search/How-to-graph-timechart-of-top-5-processes-for-the-metric/m-p/197561#M57086 <P>Hi All. If the user selects %_Processor_Time,then I need to show the graph for avg(%_Processor_Time) for top 5 processes that consumes %_Processor_Time. I got the top 5 processes using the search but unable to write the timechart command in the same query to display graph.</P> <P>index=winserver_process sourcetype="PerfmonMk:Process" NOT instance=Idle NOT instance=_Total host="ddweng09" | eval Process=upper(instance) | table Process %_Processor_Time | sort - %_Processor_Time | dedup Process | head 5</P> Mon, 28 Sep 2020 17:25:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-graph-timechart-of-top-5-processes-for-the-metric/m-p/197561#M57086 vaishnavi07 2020-09-28T17:25:56Z https://community.splunk.com/t5/Splunk-Search/How-to-graph-timechart-of-top-5-processes-for-the-metric/m-p/197562#M57087 <P>Can anyone please help me on this?</P> Thu, 28 Aug 2014 05:48:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-graph-timechart-of-top-5-processes-for-the-metric/m-p/197562#M57087 vaishnavi07 2014-08-28T05:48:07Z https://community.splunk.com/t5/Splunk-Search/How-to-graph-timechart-of-top-5-processes-for-the-metric/m-p/197563#M57088 <P>Throw it all into a subsearch that returns the processes, then run your timechart command in the outer search:</P> <PRE><CODE>index=winserver_process sourcetype="PerfmonMk:Process" NOT instance=Idle NOT instance=_Total host="ddweng09" [search index=winserver_process sourcetype="PerfmonMk:Process" NOT instance=Idle NOT instance=_Total host="ddweng09" | eval Process=upper(instance) | table Process %_Processor_Time | sort - %_Processor_Time | dedup Process | head 5 | fields Process] | timechart avg(%_Processor_Time) by Process </CODE></PRE> Thu, 28 Aug 2014 07:23:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-graph-timechart-of-top-5-processes-for-the-metric/m-p/197563#M57088 Ayn 2014-08-28T07:23:26Z https://community.splunk.com/t5/Splunk-Search/How-to-graph-timechart-of-top-5-processes-for-the-metric/m-p/197564#M57089 <P>Thanks I used the same and its working.</P> Tue, 02 Sep 2014 07:55:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-graph-timechart-of-top-5-processes-for-the-metric/m-p/197564#M57089 vaishnavi07 2014-09-02T07:55:32Z