Splunk Search

Display the top 5 line chart field values

mcg_connor
Path Finder

I'm having some trouble with getting the top 5 line values on a line chart. My current search is below

index=db  sourcetype="dbmetrics" db_type IN (DB2, SQLSERVER) 
|eval db_inst=db_instance +" - "   +application
|eval db_app=database +" - " +application
|eval db_info=coalesce(db_app, db_inst)
|timechart span=1h eval(round(avg(db_connections),0)) as DB values(DB) by db_info useother=false limit=0

The problem is that when I add where MAX in top5 I get the warning splunk Series filtering is disabled if a split-by field average.
Is there another way to get this to work?
Currently it looks like this but I want it to just show the top 5 lines.
alt text

Note: I have to take the average of db_connections due to certain db_instances having multiple events per hour

Thanks for any help.

0 Karma
1 Solution

woodcock
Esteemed Legend

Why can't you just use this?

...  |timechart span=1h eval(round(avg(db_connections),0)) as DB values(DB) by db_info useother=false limit=5

View solution in original post

woodcock
Esteemed Legend

Why can't you just use this?

...  |timechart span=1h eval(round(avg(db_connections),0)) as DB values(DB) by db_info useother=false limit=5

Sukisen1981
Champion
|addtotals col=f row=t | sort - Total| head 5|fields - Total
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...