- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
mcg_connor
Path Finder
09-09-2019
09:47 AM
I'm having some trouble with getting the top 5 line values on a line chart. My current search is below
index=db sourcetype="dbmetrics" db_type IN (DB2, SQLSERVER)
|eval db_inst=db_instance +" - " +application
|eval db_app=database +" - " +application
|eval db_info=coalesce(db_app, db_inst)
|timechart span=1h eval(round(avg(db_connections),0)) as DB values(DB) by db_info useother=false limit=0
The problem is that when I add where MAX in top5
I get the warning splunk Series filtering is disabled if a split-by field average.
Is there another way to get this to work?
Currently it looks like this but I want it to just show the top 5 lines.
Note: I have to take the average of db_connections due to certain db_instances having multiple events per hour
Thanks for any help.
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

woodcock
Esteemed Legend
09-09-2019
02:47 PM
Why can't you just use this?
... |timechart span=1h eval(round(avg(db_connections),0)) as DB values(DB) by db_info useother=false limit=5
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

woodcock
Esteemed Legend
09-09-2019
02:47 PM
Why can't you just use this?
... |timechart span=1h eval(round(avg(db_connections),0)) as DB values(DB) by db_info useother=false limit=5
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Sukisen1981
Champion
09-09-2019
11:21 AM
|addtotals col=f row=t | sort - Total| head 5|fields - Total
