Splunk Search

Display the top 5 line chart field values

mcg_connor
Path Finder

I'm having some trouble with getting the top 5 line values on a line chart. My current search is below

index=db  sourcetype="dbmetrics" db_type IN (DB2, SQLSERVER) 
|eval db_inst=db_instance +" - "   +application
|eval db_app=database +" - " +application
|eval db_info=coalesce(db_app, db_inst)
|timechart span=1h eval(round(avg(db_connections),0)) as DB values(DB) by db_info useother=false limit=0

The problem is that when I add where MAX in top5 I get the warning splunk Series filtering is disabled if a split-by field average.
Is there another way to get this to work?
Currently it looks like this but I want it to just show the top 5 lines.
alt text

Note: I have to take the average of db_connections due to certain db_instances having multiple events per hour

Thanks for any help.

0 Karma
1 Solution

woodcock
Esteemed Legend

Why can't you just use this?

...  |timechart span=1h eval(round(avg(db_connections),0)) as DB values(DB) by db_info useother=false limit=5

View solution in original post

woodcock
Esteemed Legend

Why can't you just use this?

...  |timechart span=1h eval(round(avg(db_connections),0)) as DB values(DB) by db_info useother=false limit=5

Sukisen1981
Champion
|addtotals col=f row=t | sort - Total| head 5|fields - Total
0 Karma
Get Updates on the Splunk Community!

Buttercup Games: Further Dashboarding Techniques (Part 2)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Index This | What is the next number in the series? 7,645 5,764 4,576…

February 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Buttercup Games: Further Dashboarding Techniques

Hello! We are excited to kick off a new series of blogs from SplunkTrust member ITWhisperer, who demonstrates ...