First, you can simplify the timechart part by using per_second to sum the MB, and divide by 60, for example:
index=performance network42 MBytes | timechart span=60s per_second(MBytes) as MBpersecond by guest usenull=f useother=f
If you want to find the top ten spikes over a 60s period, you'd sort:
index=performance network42 MBytes | timechart span=60s per_second(MBytes) as MBpersecond by guest usenull=f useother=f | sort 10 MBpersecond
If you wanted to look for the busiest hosts, globally, you wouldn't use timechart at all:
index=performance network42 MBytes | stats sum(MBytes) as MBtotal by guest | sort 10 MBtotal
... View more