How to use top in timechart

[mprreddy51]

Hi All,

I have a requirement to use TOP 4 in the timechart command:

Below is my search:

index=_internal |timechart count by sourcetype limit=5 span=1d|addcoltotals

(7DAYS DATA)
I need the top 4 column values of (sourcetype) as shown in the screenshot like SPLUNKD,SPLUNK_UI_ACCESS,SPLUNK_WEB_ACCESS,SPLUNK_WEB_SERVICE only

Thanks
PR

[somesoni2 · Accepted solution]

Try like this

index=_internal | bucket span=1d _time | stats count by _time sourcetype | eventstats sum(count) as total by sourcetype | sort - total | streamstats current=f window=1 values(total) as prev | eval sno=case(isnull(prev),1,prev=total,0,1=1,1) | accum sno | where sno<5 | table _time sourcetype count | xyseries _time sourcetype count | addcoltotals

[mprreddy51]

Thanks Somesh

[sundareshr]

Couldn't the top 4 sourcetypes be different for each day?