I have a search as follows:
My search | timechart span=1h limit=0 count by users
Which displays a line graph for the past 7 days. Now I'm looking to modify the search to display only the top 5 users (based on the event count) in a pie chart. How can I modify my search to get the result like that?
to show it with the hour try this:
My search |bucket _time span=1h| stats count by user _time|eval date=strftime(_time,"%D %H:%M")|eval userHour=user+" - "+date|sort - count|head 5|fields userHour count