Splunk Search

Why does limit=x on chart command doesn't work?

morethanyell
Builder

this search string

    sourcetype=something
    | chart sum(views) as Views over Uploader limit=5
    | sort - Views

easily gives you the idea that what you're asking is "give me the top 5 most viewed video of the uploaders". But it doens't work. I fully understand now that you head to use the head command to trim the result to the top 5. But why? Working search string:

    sourcetype=something
    | chart sum(views) as Views over Uploader
    | sort - Views
    | head 5
1 Solution

Ayn
Legend

limit is used for limiting how many columns the chart command should output when splitting by multiple fields, so if you do chart count by field1,field2 limit=5, that means Splunk will limit the field2 columns to 5. It doesn't take effect when splitting by only one field.

Also even if the limit argument would work like you had expected you would end up with undesired results in your first search. If you grab the first 5 results and THEN sort by Views, you'll likely not end up with the top 5 values as you didn't do the sorting until after you've limited the results.

View solution in original post

surenderjat
New Member

Ayn answered the reason why limit doesn't work on chart.
For you to get the desired result you can do the following after your chart command line.
| sort 5 views

0 Karma

Ayn
Legend

limit is used for limiting how many columns the chart command should output when splitting by multiple fields, so if you do chart count by field1,field2 limit=5, that means Splunk will limit the field2 columns to 5. It doesn't take effect when splitting by only one field.

Also even if the limit argument would work like you had expected you would end up with undesired results in your first search. If you grab the first 5 results and THEN sort by Views, you'll likely not end up with the top 5 values as you didn't do the sorting until after you've limited the results.

morethanyell
Builder

The training explained this but for some reason, I did not get it. It just clicked now. Thanks a lot, Ayn!

Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...