Splunk Search

Worst X in timechart


When you have a timechart, by default you get the largest 10 values, then everything else bucketed into OTHER.

Can anyone think of an effective way to get the smallest 10 (or X) in a timechart?

What I have is KBps, and I want to find the values that have the worst performance over time.

Tags (2)


Sure. The answer to this question takes you back to the old clunky syntax for changing how many split-by values would be shown. The old syntax to change from 10 hosts to 50 hosts was:

<your search> | timechart count by host where sum in top50

and this was of course later streamlined to :

<your search> | timechart count by host limit=50

but the old verbose syntax still works, and indeed can can do "bottom50":

<your search> | timechart count by host where sum in bottom50
0 Karma

Splunk Employee
Splunk Employee

If you disable OTHER does that have the desired effect? Something like:

... | timechart useother=false limit=10 min(KBps) by host
0 Karma


I believe that would show the 10 largest minimums.

I thought of a hacky double search way...

sourcetype=foo [search sourcetype=foo | stats avg(KBps) as avg by host | sort -avg | head 10 | fields + host] | timechart avg(KBps) by host

but I was hoping for something more elegant.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!