Splunk Search

Quick Question: Charting maximum values

wyang6
Path Finder

<option
name="charting.data.count">3</option>

<option
name="charting.chart">bar</option>

The lines above graphs a bar chart with values from the first 3 rows. How can I instead graph the highest 3 values? In addition, how can I scale the axis such that it is normalized with respect to the maximum value?

Thank you.

Tags (3)
0 Karma

hazekamp
Builder

To graph the 3 highest values you can limit your search results to the 3 highest values. Depending on your search limits can be done in a few different methods.

For a single count field (i.e. when using stats):

| top limit=3 foo
| stats count by foo | sort 3 - <count_field>

For mult-dimensional count fieds (i.e. when using chart):

| addtotals | sort 3 - Total

For first 'n' results:

| head 3
0 Karma

hazekamp
Builder

For the search, you can do "| top limit=0". On the dashboard side, if you are using simple XML try the showPager option.

0 Karma

wyang6
Path Finder

Thanks. If I also want a table with all the rows displayed, how can I get around

top limit=n
OR
head n

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...