Limit to first 10 counts

[Rajaion]

Hello community,

I am having a problem displaying a graph. I have an index that contains incidents from several monitoring tools. I need to pull up a top 10 of the most recurring alerts (that's done).

However, on this top 10, I am asked for a graph to show the evolution of the number of errors in this top per week (in order to see for example when a fix has been deployed). And this is where I encounter a problem: in my query, I have my top 10 but I have an OTHER which brings together everything that is after the top 10:

Rajaion_0-1704203704535.png

Here is the query that causes this graph:

index=oncall_prod
| search routingKey != "routingdynatrace_cluster"
| dedup incidentNumber
| rename entityDisplayName as Service
| timechart span=1w count by Service 
| sort - count limit=10

I tried to use "head" or "top" to force the display of the first 10 results only but in the case of "head", it doesn't change anything, and in the case of "top", my screen remains empty.
I've searched the forum and it's often these two answers that come up but in my case, it doesn't work. Do you know how to remove the OTHER to only have the first 10 results in my graph?

Sincerely,

Rajaion

[dtburrows3 · Accepted solution]

You can try 

| timechart span=1w useother=false limit=10 count by Service

 This should limit to only the top 10 and also discard any events that don't fall into the top 10.

[CJ117]

How can this be used to find the last 10 events in chronological order? 

[Rajaion]

Hello @dtburrows3,

I didn't know about this "useother" option, and it works, it's exactly what I was looking for:

Rajaion_0-1704204309989.png

Thank you very much for your help.

Sincerely,

Lionel M.