I have a code. It can get the top 3 IPs by day, and show it in a bar chart.
... earliest=-10d@d latest=-0d@d | bucket _time span=1d | top 3 IP by _time| timechart span=1d sum(count) by IP
Question one is: these bars aren't close, not every IP will be top 3 every day.
I mean these bars disperse in everywhere.
How could I make these bars be close?
Question two is: there are too many IPs, and my chart can't show them all.
(I mean this=>
How could I show all of these blocks?
My English is not good, I try to describe my questions carefully. Hope you can understand what I mean.
Thanks a lot. 😃