topic Re: Using a timechart, why are all the results not being shown on the dashboard? in Dashboards & Visualizations

Using a timechart, why are all the results not being shown on the dashboard?

alanxu — Fri, 28 Aug 2015 15:49:15 GMT

The search I am using is

host=... source = ... SP | timechart latest(TIME) as Completion_Time by BeginName | eval Completion_Time=tonumber(replace(Completion_Time,"(\d+):(\d+):(\d+)","\1.\2"))

So for BeginName there should have 26 different names, but on my dashboard, I only have 10 names. I was wondering if it's because all the names wouldn't fit?

Re: Using a timechart, why are all the results not being shown on the dashboard?

acharlieh — Fri, 28 Aug 2015 16:19:12 GMT

This is where the limit argument to timechart is useful to know, the others are included in the "OTHER" column. Splunk has a default of 10 here because often timechart is displayed in a graph, and as the number of series grows, it takes more and more to display (and if you have too many distinct series it may not even display correctly). But if you want to ensure that you have all series, just change:

| timechart latest(TIME) as Completion_Time by BeginName

to:

| timechart limit=0 latest(TIME) as Completion_Time by BeginName

As you're doing a latest instead of some of the other stats functions out there, I'm not sure what your source data is, but you may also be interested in the xyseries command to turn rows of data into a tabular format.

Re: Using a timechart, why are all the results not being shown on the dashboard?

alacercogitatus — Fri, 28 Aug 2015 16:20:24 GMT

Yes, by default timechart only shows 10 from the by clause. You can change it like this:

| timechart limit=25 latest(TIME) as Completion_Time by BeginName

You can also remove the NULL and OTHER fields, using the options outlined here: http://docs.splunk.com/Documentation/Splunk/6.2.5/SearchReference/timechart

Re: Using a timechart, why are all the results not being shown on the dashboard?

alanxu — Fri, 28 Aug 2015 16:59:50 GMT

Your answer was great I just chose the earlier one because it was similar

Re: Using a timechart, why are all the results not being shown on the dashboard?

alanxu — Fri, 28 Aug 2015 16:59:58 GMT

Thank you for your help