When using limit function in chart command, Splunk automatically adds columns and filters based on largest number.
Are we able to change to filter based on the SMALLEST number instead?
Ex:
index="_internal" | chart count over component by group limit=5
Thanks.
... View more