Splunk Search

## How to get a timechart for two values, but not sort by the split-by field alphabetically?

Engager

I'm trying to plot to two separate values against another value like this

``````timechart avg(x) avg(y) by z
``````

And I want to limit the results to the top 5 values. The problem comes in when I use limit to achieve this. It will score z in alphabetical order (each field value z occurs the same amount of times as the rest). How can I get a timechart of these two values, limited to only the z values that have the greatest, x, y values?

Tags (5)
1 Solution
Legend

Try this

``````... |  bin _time as time | stats avg(bytes) as x avg(spent) as y by time z | sort z x y | streamstats window=6 count by z x y | where count<6 | chart values(x) as x values(y) as y over time by z  | eval time=strftime(time, "%x %X")
``````
Legend

Try this

``````... |  bin _time as time | stats avg(bytes) as x avg(spent) as y by time z | sort z x y | streamstats window=6 count by z x y | where count<6 | chart values(x) as x values(y) as y over time by z  | eval time=strftime(time, "%x %X")
`````` SplunkTrust

Please give an example of what your desired result looks like and how that differs from timechart's default behaviour.

Engager

For instance let say foo and bar have the highest values of x. I want to create a timechart of values x and y by z and I want to display the ones with top value.

If I do `Timechart x y by z limit=x` it will instead return the z values that are first alphabetically and not ones that have highest x values.  