Can we change how limit function behaves in chart command?

nyplawrencet — Tue, 08 Dec 2015 05:03:53 GMT

When using limit function in chart command, Splunk automatically adds columns and filters based on largest number.

Are we able to change to filter based on the SMALLEST number instead?

Ex:

index="_internal" | chart count over component by group limit=5

Thanks.

Re: Can we change how limit function behaves in chart command?

lguinn2 — Tue, 08 Dec 2015 06:05:42 GMT

You can't change how limit works, but you can do this:

index="_internal" 
| stats count by component group 
| sort 5 count
| xyseries component group count