I want to use timechart to show a graph of the progress of an item so I use this command
| timechart span=1w count by plugin
the problem is I have too many plugins. I want to limit the chart to only the top 5 plugin's over the time period
So something like this but this dosn't work
| timecart span=1w top 5 plugin
Anyone know how to use top with timechart ??
I got it thanks the right syntax to use for this is
| timechart useother=F span=1w limit=5 count by plugin
this says to useother=false so that other is not on the chart and the limit is 5
You could try to use subsearch:
Something like this:
index=* [search index=* | stats count by plugin | sort - count | head 5 | fields + plugin] | timechart span=1w count by plugin
OK so i found out that LIMIT reduces to the top "n" number of items like this
| timechart span=1w limit=5 count by plugin
this gives me the top 5 but puts in the other field with all the ones not in the top 5.
Anyone know how to not show other in the chart???