Splunk Search

Worst X in timechart

vbumgarner
Contributor

When you have a timechart, by default you get the largest 10 values, then everything else bucketed into OTHER.

Can anyone think of an effective way to get the smallest 10 (or X) in a timechart?

What I have is KBps, and I want to find the values that have the worst performance over time.

Tags (2)

sideview
SplunkTrust
SplunkTrust

Sure. The answer to this question takes you back to the old clunky syntax for changing how many split-by values would be shown. The old syntax to change from 10 hosts to 50 hosts was:

<your search> | timechart count by host where sum in top50

and this was of course later streamlined to :

<your search> | timechart count by host limit=50

but the old verbose syntax still works, and indeed can can do "bottom50":

<your search> | timechart count by host where sum in bottom50
0 Karma

bwooden
Splunk Employee
Splunk Employee

If you disable OTHER does that have the desired effect? Something like:

... | timechart useother=false limit=10 min(KBps) by host
0 Karma

vbumgarner
Contributor

I believe that would show the 10 largest minimums.

I thought of a hacky double search way...

sourcetype=foo [search sourcetype=foo | stats avg(KBps) as avg by host | sort -avg | head 10 | fields + host] | timechart avg(KBps) by host

but I was hoping for something more elegant.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...