How to get first 10 search results on timechart

[tkadale]

I want to show a graph for min free disk space for the hosts. But I want to show only first 10 hosts on graph having free disk space as lowest.
My basic query is:
index="tougou" sourcetype="disk" | fields free_disk_MB, host | timechart min(free_disk_MB) by host limit=10 useother=f

How to improve this query to get only first 10 hosts having lowest free disk space?

[Christian]

Hi,

i would say this will solve you problem :
http://www.splunk.com/base/Documentation/latest/SearchReference/Head

or in your example :
index="tougou" sourcetype="disk" | fields free_disk_MB, host | timechart min(free_disk_MB) by host limit=10 useother=f | head 10

[Christian]

well it depends on your query, head will return you the first 10 rows of your search so you either sort it before or using the top command http://www.splunk.com/base/Documentation/latest/SearchReference/top , which is probably the easier way 🙂 sorry didn't think on that before

[tkadale]

Will it give me the top users having lowest free disk space, or it will give me first 10 results. I want those 10 users having lowest free disk space.