Splunk Search

Chart command.

sandeepmakkena
Contributor

index=aos_transaction

| chart count by payments, geo
| addtotals col=t
| sort -Total
| head 10

I want to display only top 10 payments with geo breakdown. when I use the above command my total is also showing in the bar chat.

Tags (2)
0 Karma

somesoni2
Revered Legend

Try this

index=aos_transaction 
| chart count by payments, geo
| addtotals
| sort -Total
| head 10

sandeepmakkena
Contributor

I alredy tried that but, the problem is when displaying as chart it is including total in the chart. I just want it to be used for sorting.

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...