Splunk Search

Display the top 5 line chart field values

mcg_connor
Path Finder

I'm having some trouble with getting the top 5 line values on a line chart. My current search is below

index=db  sourcetype="dbmetrics" db_type IN (DB2, SQLSERVER) 
|eval db_inst=db_instance +" - "   +application
|eval db_app=database +" - " +application
|eval db_info=coalesce(db_app, db_inst)
|timechart span=1h eval(round(avg(db_connections),0)) as DB values(DB) by db_info useother=false limit=0

The problem is that when I add where MAX in top5 I get the warning splunk Series filtering is disabled if a split-by field average.
Is there another way to get this to work?
Currently it looks like this but I want it to just show the top 5 lines.
alt text

Note: I have to take the average of db_connections due to certain db_instances having multiple events per hour

Thanks for any help.

0 Karma
1 Solution

woodcock
Esteemed Legend

Why can't you just use this?

...  |timechart span=1h eval(round(avg(db_connections),0)) as DB values(DB) by db_info useother=false limit=5

View solution in original post

woodcock
Esteemed Legend

Why can't you just use this?

...  |timechart span=1h eval(round(avg(db_connections),0)) as DB values(DB) by db_info useother=false limit=5

Sukisen1981
Champion
|addtotals col=f row=t | sort - Total| head 5|fields - Total
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...