Dashboards & Visualizations

"Other" in timechart- How do I increase default limit to show all hosts?

nowplaying
Explorer

I've come across this problem before but can't find it in the answers site.

I have a timechart within in an advanced dashboard which I'm charting a value by host and it's only showing 10 valid hosts the remaining hosts are put into this "Other" value. How do I increase the this default limit to show all the my hosts.

Thanks

Labels (1)
Tags (1)

vrmandadi
Builder

Use this in your timechart command

| timechart count by usenull=f useother=f

cmerriman
Super Champion

if you put limit=0, there isn't a limit at all.

erez10121012
Path Finder

thanks

WORKD FOR ME

0 Karma

cmerriman
Super Champion

useother=f just leaves the 'other' field out of the results but still limits the amount of fields returned.

vijaykumartcs
Explorer

How do i remove other from the timechart..,How do i remove other from the timechart

0 Karma

nmaroulis_splun
Splunk Employee
Splunk Employee

The best way is to use useother=f with timechart
ex |timechart useother=f count by foobar

Stephen_Sorkin
Splunk Employee
Splunk Employee

You can use the "limit" argument to timechart:

... | timechart count by foo limit=20

or

... | timechart count by foo limit=100

sideview
SplunkTrust
SplunkTrust

And also if/when you do want it to only show the top N values but you do NOT want it to roll up everthing else under 'OTHER', you can pass useother="f" to timechart. ( http://www.splunk.com/base/Documentation/latest/SearchReference/Timechart )

Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...