https://community.splunk.com/t5/Splunk-Search/How-to-limit-the-number-of-bars-in-a-bar-graph/m-p/323129#M96414 <P>I have a query that produces a bar graph of the number of hits in a page. I want to limit this to the top 5-10 values, but I can't seem to get either the limit or top function to do what I need. What am I missing here?</P> <P>index= sourcetype=source= pageURL=&lt; dynamic field input &gt;| stats count as PageHit by uniqueID | stats count as UserCount by PageHit | sort PageHit</P> <P>Adding limit or top cannot seem to get the same graph as the full query produces, and just removes the small values.</P> Wed, 06 Dec 2017 20:13:51 GMT brajaram 2017-12-06T20:13:51Z https://community.splunk.com/t5/Splunk-Search/How-to-limit-the-number-of-bars-in-a-bar-graph/m-p/323129#M96414 <P>I have a query that produces a bar graph of the number of hits in a page. I want to limit this to the top 5-10 values, but I can't seem to get either the limit or top function to do what I need. What am I missing here?</P> <P>index= sourcetype=source= pageURL=&lt; dynamic field input &gt;| stats count as PageHit by uniqueID | stats count as UserCount by PageHit | sort PageHit</P> <P>Adding limit or top cannot seem to get the same graph as the full query produces, and just removes the small values.</P> Wed, 06 Dec 2017 20:13:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-limit-the-number-of-bars-in-a-bar-graph/m-p/323129#M96414 brajaram 2017-12-06T20:13:51Z https://community.splunk.com/t5/Splunk-Search/How-to-limit-the-number-of-bars-in-a-bar-graph/m-p/323130#M96415 <P>Doing <CODE>| sort PageHit</CODE> will, by default, sort from lowest values to highest values. If you want the top five, try this:</P> <PRE><CODE>index= sourcetype=source= pageURL=&lt; dynamic field input &gt; | stats count as PageHit by uniqueID | stats count as UserCount by PageHit | sort -PageHit | head 5 </CODE></PRE> <P>By using <CODE>| sort -PageHit</CODE> instead, you will reverse the sorting order, and then <CODE>|head 5</CODE> will limit to the first five items. </P> Wed, 06 Dec 2017 20:21:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-limit-the-number-of-bars-in-a-bar-graph/m-p/323130#M96415 elliotproebstel 2017-12-06T20:21:05Z https://community.splunk.com/t5/Splunk-Search/How-to-limit-the-number-of-bars-in-a-bar-graph/m-p/323131#M96416 <P>@elliotproebstel - That will work fine, but this is more succinct...</P> <PRE><CODE>| sort 5 - PageHit </CODE></PRE> Wed, 06 Dec 2017 21:53:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-limit-the-number-of-bars-in-a-bar-graph/m-p/323131#M96416 DalJeanis 2017-12-06T21:53:32Z https://community.splunk.com/t5/Splunk-Search/How-to-limit-the-number-of-bars-in-a-bar-graph/m-p/323132#M96417 <P>Ohh, didn't realize that was an option! Thanks!</P> Wed, 06 Dec 2017 21:57:38 GMT https://community.splunk.com/t5/Splunk-Search/How-to-limit-the-number-of-bars-in-a-bar-graph/m-p/323132#M96417 elliotproebstel 2017-12-06T21:57:38Z https://community.splunk.com/t5/Splunk-Search/How-to-limit-the-number-of-bars-in-a-bar-graph/m-p/323133#M96418 <P>Thanks! I didn't even know head was a solution, worked fine for me.</P> Wed, 06 Dec 2017 22:01:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-limit-the-number-of-bars-in-a-bar-graph/m-p/323133#M96418 brajaram 2017-12-06T22:01:32Z