Splunk Search

How to edit my search to change a line graph into pie chart to display only the top 5 results?

Builder

I have a search as follows:

My search | timechart span=1h limit=0 count by users

Which displays a line graph for the past 7 days. Now I'm looking to modify the search to display only the top 5 users (based on the event count) in a pie chart. How can I modify my search to get the result like that?

0 Karma
1 Solution

Super Champion
My search |top 5 users

that should do it, but it won't be hourly.

View solution in original post

0 Karma

Super Champion
My search |top 5 users

that should do it, but it won't be hourly.

View solution in original post

0 Karma

Builder

And how can I display a tabular format of those top 5 users activities considering activity is a common field for all the users next to that pie chart?

0 Karma

Super Champion

to show it with the hour try this:

 My search |bucket _time span=1h| stats count by user _time|eval date=strftime(_time,"%D %H:%M")|eval userHour=user+" - "+date|sort - count|head 5|fields userHour count
0 Karma