Dashboards & Visualizations

How do you get a stacked bar chart that lists only the top X users?

richardphung
Communicator

I have data that is structured as such:

Using the following:

index="myindex"  |  chart count over username by result

I get a nice stacked bar chart.. and a table as such:
User1, success, count
User1, failure, count
User2, success, count
User3, failure, count

How can I only chart the top X users?

|top 20 username

Gets me the top values.. but limit=20 doesn't seem to work with chart

Tags (2)
0 Karma
1 Solution

richardphung
Communicator
index="myindex"
    [search index="myindex"  
    | top  10 username 
    | fields username
    | sort -count]
| chart count BY username result

*Notice, the no-pipe into the 2nd search.

View solution in original post

0 Karma

richardphung
Communicator
index="myindex"
    [search index="myindex"  
    | top  10 username 
    | fields username
    | sort -count]
| chart count BY username result

*Notice, the no-pipe into the 2nd search.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...