Limit for chart with split-by clause ?

Hi,

i have this search:

index=foo | eval length=length(_raw) | chart eval(sum(length)/1024/1024) as MiB by application

Now i just want the first 15 apps. But using "limit=15" says: The following options were specified but have no effect when a split-by clause is not provided:limit.

How can i use limit?

Regards, Jens

asked 07 Dec '11, 12:01

JensT
124●1●7
accept rate: 25%

One Answer:

oldest newest most voted

0	so are you doing: index=foo \| eval length=length(_raw) \| chart limit=15 eval(sum(length)/1024/1024) as MiB by application ? link answered 07 Dec '11, 12:07 Joetron 753●1●4 accept rate: 20% Thats what i would like to do, but thats not working. -- Jens (07 Dec '11, 12:09) JensT

Post your answer

toggle preview

Follow this question

Email:

RSS:

Answers

Answers + Comments

Markdown Basics

*italic* or _italic_
**bold** or __bold__
link:[text](http://url.com/ "Title")
image?![alt text](/path/img.jpg "Title")
numbered list: 1. Foo 2. Bar
to add a line break simply add two spaces to where you would like the new line to be.
basic HTML tags are also supported

learn more about Markdown

Tags:

chart ×134
limit ×15

Asked: 07 Dec '11, 12:01

Seen: 357 times

Last updated: 07 Dec '11, 12:09

Limit for chart with split-by clause ?

Follow this question

Splunk Resources

Related questions