Hi,
i have this search:
index=foo | eval length=length(_raw) | chart eval(sum(length)/1024/1024) as MiB by application
Now i just want the first 15 apps. But using "limit=15" says:
The following options were specified but have no effect when a split-by clause is not provided:limit.
How can i use limit?
Regards, Jens
so are you doing:
index=foo | eval length=length(_raw) | chart limit=15 eval(sum(length)/1024/1024) as MiB by application
?
To limit the queries with the "chart" command, just use the "sort" command and then indicate the number of lines you want to display:
index=foo | eval length=length(_raw) | chart eval(sum(length)/1024/1024) as MiB by application | sort 15 -MiB
It appears that limit only works for timecharts, but you should be able to get the answer you are wanting by doing a reverse sort, to get the "top" entries to appear first, and then do a head, to show only the first x rows.
So your search string should be :
index=foo | eval length=length(_raw) | chart eval(sum(length)/1024/1024) as MiB by application | sort -MiB | head 15
I have the exact same issue. I'm doing this query, but get that exact error message.
index=myindex sourcetype=access_combined host=somehost | chart limit=7 count by root
Leaving out the limit=7 works fine, but gives a chart that has about 20 items, which isn't important for my dashboard, and doesn't look very good. I just need the top 6-8 context roots displayed with HTTP request counts.
so are you doing:
index=foo | eval length=length(_raw) | chart limit=15 eval(sum(length)/1024/1024) as MiB by application
?
Thats what i would like to do, but thats not working.
-- Jens