Limit for chart with split-by clause ?

[JensT]

Hi,

i have this search:

index=foo | eval length=length(_raw) | chart eval(sum(length)/1024/1024) as MiB by application

Now i just want the first 15 apps. But using "limit=15" says:
The following options were specified but have no effect when a split-by clause is not provided:limit.

How can i use limit?

Regards, Jens

[rmanrique]

To limit the queries with the "chart" command, just use the "sort" command and then indicate the number of lines you want to display:

index=foo | eval length=length(_raw) | chart eval(sum(length)/1024/1024) as MiB by application | sort 15 -MiB

[russellliss]

It appears that limit only works for timecharts, but you should be able to get the answer you are wanting by doing a reverse sort, to get the "top" entries to appear first, and then do a head, to show only the first x rows.

So your search string should be :

index=foo | eval length=length(_raw) | chart eval(sum(length)/1024/1024) as MiB by application | sort -MiB | head 15

[combinatorics]

I have the exact same issue. I'm doing this query, but get that exact error message.

index=myindex sourcetype=access_combined host=somehost | chart limit=7 count by root

Leaving out the limit=7 works fine, but gives a chart that has about 20 items, which isn't important for my dashboard, and doesn't look very good. I just need the top 6-8 context roots displayed with HTTP request counts.

[RicoSuave · Accepted solution]

so are you doing:
index=foo | eval length=length(_raw) | chart limit=15 eval(sum(length)/1024/1024) as MiB by application

?

[JensT]

Thats what i would like to do, but thats not working.

-- Jens