topic "Other" in timechart- How do I increase default limit to show all hosts? in Dashboards & Visualizations

"Other" in timechart- How do I increase default limit to show all hosts?

nowplaying — Fri, 13 Jan 2023 17:28:19 GMT

I've come across this problem before but can't find it in the answers site.

I have a timechart within in an advanced dashboard which I'm charting a value by host and it's only showing 10 valid hosts the remaining hosts are put into this "Other" value. How do I increase the this default limit to show all the my hosts.

Thanks

Re: "Other" in timechart

Stephen_Sorkin — Wed, 22 Dec 2010 04:58:12 GMT

You can use the "limit" argument to timechart:

... | timechart count by foo limit=20

... | timechart count by foo limit=100

Re: "Other" in timechart

sideview — Wed, 22 Dec 2010 05:49:42 GMT

And also if/when you do want it to only show the top N values but you do NOT want it to roll up everthing else under 'OTHER', you can pass useother="f" to timechart. ( http://www.splunk.com/base/Documentation/latest/SearchReference/Timechart )

Re: "Other" in timechart

nmaroulis_splun — Wed, 04 Feb 2015 17:33:48 GMT

The best way is to use useother=f with timechart
ex |timechart useother=f count by foobar

Re: "Other" in timechart

vijaykumartcs — Wed, 12 Oct 2016 11:05:59 GMT

How do i remove other from the timechart..,How do i remove other from the timechart

Re: "Other" in timechart

cmerriman — Wed, 12 Oct 2016 14:31:48 GMT

if you put limit=0, there isn't a limit at all.

Re: "Other" in timechart

cmerriman — Wed, 12 Oct 2016 14:33:02 GMT

useother=f just leaves the 'other' field out of the results but still limits the amount of fields returned.

Re: "Other" in timechart

vrmandadi — Thu, 02 Feb 2017 20:19:45 GMT

Use this in your timechart command

| timechart count by usenull=f useother=f

Re: "Other" in timechart

erez10121012 — Fri, 13 Jan 2023 13:20:43 GMT

thanks

WORKD FOR ME