How to limit the number of bars in a bar graph

[brajaram]

I have a query that produces a bar graph of the number of hits in a page. I want to limit this to the top 5-10 values, but I can't seem to get either the limit or top function to do what I need. What am I missing here?

index= sourcetype=source= pageURL=< dynamic field input >| stats count as PageHit by uniqueID | stats count as UserCount by PageHit | sort PageHit

Adding limit or top cannot seem to get the same graph as the full query produces, and just removes the small values.

[elliotproebstel · Accepted solution]

Doing | sort PageHit will, by default, sort from lowest values to highest values. If you want the top five, try this:

index= sourcetype=source= pageURL=< dynamic field input >
| stats count as PageHit by uniqueID 
| stats count as UserCount by PageHit 
| sort -PageHit
| head 5

By using | sort -PageHit instead, you will reverse the sorting order, and then |head 5 will limit to the first five items.

[brajaram]

Thanks! I didn't even know head was a solution, worked fine for me.

[DalJeanis]

@elliotproebstel - That will work fine, but this is more succinct...

| sort 5 - PageHit

[elliotproebstel]

Ohh, didn't realize that was an option! Thanks!