Hi all,
i created the the trend chart for my Task Manager log files ...some of the Task are showed in legend and remaining Tasks are grouped as OTHER ,..
How it groups the Task and put it in OTHER or it has any criteria so that it groups the Task
Plz clarify me
Thanks
poornima
It would help if you actually showed the search.
But I will try to explain in the abstract. If I run a search like this
somesearch | timechart count by task
Splunk will only graph the 10 tasks that appear most frequently. The remaining tasks will be grouped into a category named "OTHER" by default. There are options for removing the OTHER category, as well as other actions you could take to group or eliminate categories. to eliminate OTHER
somesearch | timechart useother=f count by task
Read the entry for the timechart command in the Search Reference Manual for more options.
It would help if you actually showed the search.
But I will try to explain in the abstract. If I run a search like this
somesearch | timechart count by task
Splunk will only graph the 10 tasks that appear most frequently. The remaining tasks will be grouped into a category named "OTHER" by default. There are options for removing the OTHER category, as well as other actions you could take to group or eliminate categories. to eliminate OTHER
somesearch | timechart useother=f count by task
Read the entry for the timechart command in the Search Reference Manual for more options.