Problem
Something is consuming the budget, or throwing the errors, or taking the time. There are nine thousand candidates and the viewer needs the handful that account for most of it.
Solution
Sort descending, cut at N, show the values. The sort is trivial. The cut is the pattern, and everything interesting is about what happens at the cut line.
Say what’s below it. A top ten with no total is a list of ten things and no sense of whether they’re 90% of the problem or 4% of it. An “other” row, or a share-of-total figure on each line, converts a leaderboard into an answer. Without it the viewer cannot tell a heavy-tailed distribution from a flat one, and those call for completely different responses.
Say what the ranking is over. Top ten endpoints by latency over the last hour is not the top ten at any moment inside that hour. A ranked list computed across a window silently averages away the thing that spiked for ninety seconds and then left, which on an operational dashboard is frequently the thing you were looking for.
Watch the churn. Over a high-cardinality dimension the membership of the top ten changes on every refresh, and a list that reorders itself while someone is reading it is unusable. This is the axis observability tools diverge on: Honeycomb’s whole argument is that high cardinality is where the answers are and the tooling should hold up under it, rather than pre-aggregating the interesting dimensions away before anyone can rank by them.
Use when
The distribution is genuinely skewed and the viewer’s job is triage. Which customers, which endpoints, which queries, which hosts.
Don’t use when
The values are close together. Ten items within a few percent of each other produce a ranking that is noise given an ordering, and readers treat position as meaningful whether or not it is. Show the distribution instead. Also don’t rank when the set is small enough to show entirely.
Trade-offs
Ranking imposes a total order on things that may not have one, and readers over-trust position: first and second read as meaningfully different even when they differ by a rounding error. The cut at N is arbitrary and usually invisible, so an item at position eleven is indistinguishable from one at position nine hundred. Ranked lists also concentrate attention on the head by construction, which is the point, and which means slow accumulating problems in the tail never surface. And on a shared dashboard the list becomes a scoreboard, which changes behavior in ways nobody specified.
Checklist
- Why N? Is it ten because ten is the answer or because ten fits?
- Is the total, or each item’s share of it, visible?
- Is there an “other” row, and does it carry the count of what’s in it?
- Is the ranking over the whole window, and would a per-interval ranking say something different?
- How stable is the membership between refreshes, and is the list readable while it updates?
- Are ties broken deterministically, so the order doesn’t jitter?
- Can two adjacent rows be distinguished, or are they within noise?
- Can the viewer click through to the item, and do they land somewhere scoped correctly?
- What’s the cardinality of this dimension, and does the query hold up at that cardinality?
- Does the list say what it’s ranked by, in the units the viewer thinks in?
Compare
Grafana builds this out of a bar gauge or a sorted table, which means the “other” row and the share-of-total are things whoever wrote the query has to remember, and they usually don’t. Honeycomb treats ranking as a step inside the analysis loop rather than a finished panel, so a top-N is somewhere you group by a dimension and then keep going, which suits a high-cardinality field where the interesting item was never in anyone’s top ten. Sentry ranks issues by event count and keeps a sparkline on each row, so the list carries shape as well as order and a spiking issue at position twelve is still visible. Netdata ranks per-node and per-second, so the list turns over fast enough that it reads as a live view rather than a standing. Cloudflare Radar strips the magnitudes out entirely: its top tens are a number, a name and nothing else, with no bar and no share of total. That is the most aggressive answer available to the question this pattern raises, and it holds up because for a reader who came for one fact the rank genuinely is the whole finding.
Related
Data table is this pattern without the cut, and the right answer once the viewer wants to sort by something else. Drill-down is where a rank position should take them. Filter bar is how they narrow the population before ranking it. Stacked composition answers the share-of-total question graphically. Cross-filter is what turns a list item into a scope for the rest of the page.