How to get a timechart for two values, but not sort by the split-by field alphabetically?

[Skamensky]

I'm trying to plot to two separate values against another value like this

timechart avg(x) avg(y) by z

And I want to limit the results to the top 5 values. The problem comes in when I use limit to achieve this. It will score z in alphabetical order (each field value z occurs the same amount of times as the rest). How can I get a timechart of these two values, limited to only the z values that have the greatest, x, y values?

[sundareshr · Accepted solution]

Try this

... |  bin _time as time | stats avg(bytes) as x avg(spent) as y by time z | sort z x y | streamstats window=6 count by z x y | where count<6 | chart values(x) as x values(y) as y over time by z  | eval time=strftime(time, "%x %X")

[martin_mueller]

Please give an example of what your desired result looks like and how that differs from timechart's default behaviour.

[Skamensky]

For instance let say foo and bar have the highest values of x. I want to create a timechart of values x and y by z and I want to display the ones with top value.

If I do Timechart x y by z limit=x it will instead return the z values that are first alphabetically and not ones that have highest x values.