timechart but only for the top 5

[hartfoml]

I want to use timechart to show a graph of the progress of an item so I use this command

| timechart span=1w count by plugin

the problem is I have too many plugins. I want to limit the chart to only the top 5 plugin's over the time period

So something like this but this dosn't work

| timecart span=1w top 5 plugin

Anyone know how to use top with timechart ??

[hartfoml]

I got it thanks the right syntax to use for this is

| timechart useother=F span=1w limit=5 count by plugin

this says to useother=false so that other is not on the chart and the limit is 5

[sbattista09]

would limit=5 show you the top 5 "plugin" or only limit it to some random 5 "plugins"? as in, would it show you the highest 5 counts of a "plugin"?

[msquicc]

I know this is a pretty old post, but wanted to put this here for anyone else looking.  This has bothered me for some time.  

It seems timechart, as of some version, supports 3 limit options:

limit=N

limit=topN

limit=bottomN

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Timechart

[gkanapathy · Accepted solution]

| timecart span=1w limit=5 useother=f count by plugin

[hartfoml]

thanks you beet me to it

[kbrown9392]

This does not seem to chart the top list, but a random list of 5. They are not the "top 5" in count, and not in order by count. How do we do that?

[imrago]

You could try to use subsearch:

http://docs.splunk.com/Documentation/Splunk/latest/User/HowSubsearchesWork

Something like this:

index=* [search index=* | stats count by plugin | sort - count | head 5 | fields + plugin] | timechart span=1w count by plugin

[hartfoml]

I'm going to try this to see how it comes out

[hartfoml]

OK so i found out that LIMIT reduces to the top "n" number of items like this

 | timechart span=1w limit=5 count by plugin

this gives me the top 5 but puts in the other field with all the ones not in the top 5.

Anyone know how to not show other in the chart???

[jtrimmings]

useother=f