Splunk Search

Why does limit=x on chart command doesn't work?

morethanyell
Builder

this search string

    sourcetype=something
    | chart sum(views) as Views over Uploader limit=5
    | sort - Views

easily gives you the idea that what you're asking is "give me the top 5 most viewed video of the uploaders". But it doens't work. I fully understand now that you head to use the head command to trim the result to the top 5. But why? Working search string:

    sourcetype=something
    | chart sum(views) as Views over Uploader
    | sort - Views
    | head 5
1 Solution

Ayn
Legend

limit is used for limiting how many columns the chart command should output when splitting by multiple fields, so if you do chart count by field1,field2 limit=5, that means Splunk will limit the field2 columns to 5. It doesn't take effect when splitting by only one field.

Also even if the limit argument would work like you had expected you would end up with undesired results in your first search. If you grab the first 5 results and THEN sort by Views, you'll likely not end up with the top 5 values as you didn't do the sorting until after you've limited the results.

View solution in original post

surenderjat
New Member

Ayn answered the reason why limit doesn't work on chart.
For you to get the desired result you can do the following after your chart command line.
| sort 5 views

0 Karma

Ayn
Legend

limit is used for limiting how many columns the chart command should output when splitting by multiple fields, so if you do chart count by field1,field2 limit=5, that means Splunk will limit the field2 columns to 5. It doesn't take effect when splitting by only one field.

Also even if the limit argument would work like you had expected you would end up with undesired results in your first search. If you grab the first 5 results and THEN sort by Views, you'll likely not end up with the top 5 values as you didn't do the sorting until after you've limited the results.

morethanyell
Builder

The training explained this but for some reason, I did not get it. It just clicked now. Thanks a lot, Ayn!

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...