topic Re: If I use more than 6 times append command in query the Chart command shows incorrect result in Splunk Search

If I use more than 6 times append command in query the Chart command shows incorrect result

nivethainspire_ — Wed, 28 Oct 2020 14:09:02 GMT

I ran the below query,

I expect the below Result,

But I get the below result, where "bas1" and "App" shows together as "OTHER"

And it happens after I use the chart command.

Anyone can help me out.

Re: If I use more than 6 times append command in query the Chart command shows incorrect result

isoutamo — Wed, 28 Oct 2020 14:10:16 GMT

Hi
this is due to chart's limit which is 10 by default. You could change it by adding chart limit=XX (or limit=0 to unlimited it).
Anyhow you probably should tune your search to use eg. stat and not append? There are good presentation in conf how to do it.
https://conf.splunk.com/files/2020/slides/TRU1761C.pdf
r. Ismo

Re: If I use more than 6 times append command in query the Chart command shows incorrect result

richgalloway — Wed, 28 Oct 2020 14:17:17 GMT

It's not the number of appends, it's the number of fields. By default, the chart command displays 10 fields and puts the rest into "other". To change that, use "| chart useother=f ...".

Re: If I use more than 6 times append command in query the Chart command shows incorrect result

nivethainspire_ — Thu, 29 Oct 2020 08:30:33 GMT

@richgalloway Still I face the same issue.

Re: If I use more than 6 times append command in query the Chart command shows incorrect result

isoutamo — Thu, 29 Oct 2020 08:42:26 GMT

useother=f just drop that OTHER column away. If you want to see it, then you should add limit=0 (to see all) or limit=20 (to see 20 values).