When using limit
function in chart
command, Splunk automatically adds columns and filters based on largest number.
Are we able to change to filter based on the SMALLEST number instead?
Ex:
index="_internal" | chart count over component by group limit=5
Thanks.
You can't change how limit
works, but you can do this:
index="_internal"
| stats count by component group
| sort 5 count
| xyseries component group count
You can't change how limit
works, but you can do this:
index="_internal"
| stats count by component group
| sort 5 count
| xyseries component group count