Tstats sort and get top values

[sushmitha_mj]

Here is my search
| tstats sum(Accounting.Input) as Inp, sum(Accounting.Output) as out from datamodel="Accounting" by _time span=1h , Accounting.User_Name | eval tot=round((Inp+out)/100,2) | timechart span=1h sum(tot) as "Total" | sort -"Total" limit=500 by Accounting.User_Name

Definitely not working. But the intent is to list the total usage by top 500 users total (input + output) at any given time. I am going to combine this graph with one having overall total that is (input + output) of all users at any given point. That query is working (for reference)

| tstats sum(Accounting.Input) as Inp, sum(Accounting.Output) as out from datamodel="Accounting" by _time span=1h | eval tot=round((Inp+out)/100,2) | timechart span=1h sum(tot) as "Total Usage"

I need to combine these 2 queries to form a single graph to show usage by top 500 users and overall usage.

[somesoni2 · Accepted solution]

Try this

| tstats sum(Accounting.Input) as Inp, sum(Accounting.Output) as out from datamodel="Accounting" by _time span=1h , Accounting.User_Name | eval tot=round((Inp+out)/100,2)  | sort -"Total" limit=500 by Accounting.User_Name | timechart span=1h sum(tot) as "Total"

[sushmitha_mj]

@somesoni2
Thank you... This query works !!
But.. it lists the top 500 "total" , maps it in the time range(x axis) when that value occurs. So I have just 500 values all together and the rest is null. I want the top 500 users overall. Lets say I select a time range of 7 days, I want the top 500 users for the 7 days and then I want to graph their usage for the 7 days. So the graph needs to be continuous.
Could you please help?