Dashboards & Visualizations

How do you get a stacked bar chart that lists only the top X users?

richardphung
Communicator

I have data that is structured as such:

Using the following:

index="myindex"  |  chart count over username by result

I get a nice stacked bar chart.. and a table as such:
User1, success, count
User1, failure, count
User2, success, count
User3, failure, count

How can I only chart the top X users?

|top 20 username

Gets me the top values.. but limit=20 doesn't seem to work with chart

Tags (2)
0 Karma
1 Solution

richardphung
Communicator
index="myindex"
    [search index="myindex"  
    | top  10 username 
    | fields username
    | sort -count]
| chart count BY username result

*Notice, the no-pipe into the 2nd search.

View solution in original post

0 Karma

richardphung
Communicator
index="myindex"
    [search index="myindex"  
    | top  10 username 
    | fields username
    | sort -count]
| chart count BY username result

*Notice, the no-pipe into the 2nd search.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In September, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...