Splunk Search

Quick Question: Charting maximum values

wyang6
Path Finder

<option
name="charting.data.count">3</option>

<option
name="charting.chart">bar</option>

The lines above graphs a bar chart with values from the first 3 rows. How can I instead graph the highest 3 values? In addition, how can I scale the axis such that it is normalized with respect to the maximum value?

Thank you.

Tags (3)
0 Karma

hazekamp
Builder

To graph the 3 highest values you can limit your search results to the 3 highest values. Depending on your search limits can be done in a few different methods.

For a single count field (i.e. when using stats):

| top limit=3 foo
| stats count by foo | sort 3 - <count_field>

For mult-dimensional count fieds (i.e. when using chart):

| addtotals | sort 3 - Total

For first 'n' results:

| head 3
0 Karma

hazekamp
Builder

For the search, you can do "| top limit=0". On the dashboard side, if you are using simple XML try the showPager option.

0 Karma

wyang6
Path Finder

Thanks. If I also want a table with all the rows displayed, how can I get around

top limit=n
OR
head n

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...