this search string
sourcetype=something
| chart sum(views) as Views over Uploader limit=5
| sort - Views
easily gives you the idea that what you're asking is "give me the top 5 most viewed video of the uploaders". But it doens't work. I fully understand now that you head to use the head command to trim the result to the top 5. But why? Working search string:
sourcetype=something
| chart sum(views) as Views over Uploader
| sort - Views
| head 5
limit
is used for limiting how many columns the chart
command should output when splitting by multiple fields, so if you do chart count by field1,field2 limit=5
, that means Splunk will limit the field2
columns to 5. It doesn't take effect when splitting by only one field.
Also even if the limit
argument would work like you had expected you would end up with undesired results in your first search. If you grab the first 5 results and THEN sort by Views, you'll likely not end up with the top 5 values as you didn't do the sorting until after you've limited the results.
Ayn answered the reason why limit doesn't work on chart.
For you to get the desired result you can do the following after your chart command line.
| sort 5 views
limit
is used for limiting how many columns the chart
command should output when splitting by multiple fields, so if you do chart count by field1,field2 limit=5
, that means Splunk will limit the field2
columns to 5. It doesn't take effect when splitting by only one field.
Also even if the limit
argument would work like you had expected you would end up with undesired results in your first search. If you grab the first 5 results and THEN sort by Views, you'll likely not end up with the top 5 values as you didn't do the sorting until after you've limited the results.
The training explained this but for some reason, I did not get it. It just clicked now. Thanks a lot, Ayn!