topic Re: Limit for chart with split-by clause ? in Splunk Search

Limit for chart with split-by clause ?

JensT — Wed, 07 Dec 2011 20:01:25 GMT

Hi,

i have this search:

index=foo | eval length=length(_raw) | chart eval(sum(length)/1024/1024) as MiB by application

Now i just want the first 15 apps. But using "limit=15" says:
The following options were specified but have no effect when a split-by clause is not provided:limit.

How can i use limit?

Regards, Jens

Re: Limit for chart with split-by clause ?

RicoSuave — Wed, 07 Dec 2011 20:07:28 GMT

so are you doing:
index=foo | eval length=length(_raw) | chart limit=15 eval(sum(length)/1024/1024) as MiB by application

Re: Limit for chart with split-by clause ?

JensT — Wed, 07 Dec 2011 20:09:11 GMT

Thats what i would like to do, but thats not working.

-- Jens

Re: Limit for chart with split-by clause ?

combinatorics — Thu, 31 May 2012 01:49:41 GMT

I have the exact same issue. I'm doing this query, but get that exact error message.

index=myindex sourcetype=access_combined host=somehost | chart limit=7 count by root

Leaving out the limit=7 works fine, but gives a chart that has about 20 items, which isn't important for my dashboard, and doesn't look very good. I just need the top 6-8 context roots displayed with HTTP request counts.

Re: Limit for chart with split-by clause ?

russellliss — Sat, 05 Oct 2013 04:37:58 GMT

It appears that limit only works for timecharts, but you should be able to get the answer you are wanting by doing a reverse sort, to get the "top" entries to appear first, and then do a head, to show only the first x rows.

So your search string should be :

index=foo | eval length=length(_raw) | chart eval(sum(length)/1024/1024) as MiB by application | sort -MiB | head 15

Re: Limit for chart with split-by clause ?

rmanrique — Fri, 26 Oct 2018 14:59:31 GMT

To limit the queries with the "chart" command, just use the "sort" command and then indicate the number of lines you want to display:

index=foo | eval length=length(_raw) | chart eval(sum(length)/1024/1024) as MiB by application | sort 15 -MiB