topic Re: Visualization limit in Dashboards & Visualizations

Visualization limit

arkonner — Tue, 29 Sep 2020 10:35:14 GMT

with the search below I identify the account locked-out - I am using "column chart" output and under visualization format there is no limit but as result only ten Account names are displayed. I have no idea where this limit has been introduced and I need to display all Account locked-out

Thank you in advance for the attention given

index=wineventlog source="WinEventLog:Security" sourcetype="WinEventLog:Security" Account_Name="*" EventCode=4740 OR EventCode=644 AND Account_Name!=Guest AND Account_Name!=Administrator AND Account_Name!=Anonymous | eval Account_Name = mvindex(Account_Name,1) | eval Security_ID = mvindex(Security_ID,1) | timechart span=1h useother=f count by Account_Name

Re: Visualization limit

davebrooking — Thu, 11 Aug 2016 11:21:50 GMT

The timechart command has a limit option, I thought the default was documented, but don't see it in the docs. This earlier answer states the default is 10.

Dave

Re: Visualization limit

JDukeSplunk — Thu, 11 Aug 2016 14:47:59 GMT

Yep like Dave said there is a limit=X option for timechart. Timechart can be a bear to display properly. Depending on the time range the search is run in, I often have to slice it into bigger slices using span= as well as limit.

So. If you're doing a 30 day search your timechart might look like this to get the top 50 accounts per day.

 | timechart span=1d useother=f  limit=50 count by Account_Name

Re: Visualization limit

sundareshr — Thu, 11 Aug 2016 14:50:57 GMT

Try this

index=wineventlog source="WinEventLog:Security" sourcetype="WinEventLog:Security" Account_Name="*" EventCode=4740 OR EventCode=644 AND Account_Name!=Guest AND Account_Name!=Administrator AND Account_Name!=Anonymous | eval Account_Name = mvindex(Account_Name,1) | eval Security_ID = mvindex(Security_ID,1) | timechart limit=0 span=1h useother=f count by Account_Name

Re: Visualization limit

arkonner — Thu, 11 Aug 2016 14:58:26 GMT

Thank you Dave