Can we change how limit function behaves in chart command?

[nyplawrencet]

When using limit function in chart command, Splunk automatically adds columns and filters based on largest number.

Are we able to change to filter based on the SMALLEST number instead?

Ex:

index="_internal" | chart count over component by group limit=5

Thanks.

[lguinn2 · Accepted solution]

You can't change how limit works, but you can do this:

index="_internal" 
| stats count by component group 
| sort 5 count
| xyseries component group count