https://community.splunk.com/t5/Splunk-Search/what-is-the-limit-to-the-number-of-categories-that-can-be-in-a/m-p/130314#M35506 <P><CODE>limit=0</CODE> works by not grouping the remaining categories into <CODE>Other</CODE>. </P> Sun, 12 Apr 2015 23:05:02 GMT HattrickNZ 2015-04-12T23:05:02Z https://community.splunk.com/t5/Splunk-Search/what-is-the-limit-to-the-number-of-categories-that-can-be-in-a/m-p/130306#M35498 <P>I have a timechart search that looks something like:</P> <PRE><CODE>... | timechart span=15m max(c84162281) as "Average Seizure Traffic per Line (Trunk Group)" by TG_Category | eval threshold=1 </CODE></PRE> <P><STRONG>Some Observations/Questions:</STRONG><BR /> But there is 14 categories to show and it only shows 10, and puts the remaining categories into <CODE>Other</CODE>. So that's 11 categories in total showing. <BR /> The legend seems to show the categories in alphabetical order. Can I order this by size or something else other that alphabetically?<BR /> Can I name <CODE>Other</CODE> to something else?<BR /> I can add another category to the legend using the <CODE>eval threshold=1</CODE> and this seems to appear in the legend. So there is a limit there of sorts, but not completely it seems </P> Wed, 08 Apr 2015 03:25:08 GMT https://community.splunk.com/t5/Splunk-Search/what-is-the-limit-to-the-number-of-categories-that-can-be-in-a/m-p/130306#M35498 HattrickNZ 2015-04-08T03:25:08Z https://community.splunk.com/t5/Splunk-Search/what-is-the-limit-to-the-number-of-categories-that-can-be-in-a/m-p/130307#M35499 <P>found <A href="http://answers.splunk.com/answers/223836/is-there-a-timechart-legend-limit.html?utm_source=typeahead&amp;utm_medium=newquestion&amp;utm_campaign=ahdefault">this</A> re the limit question </P> Wed, 08 Apr 2015 03:25:41 GMT https://community.splunk.com/t5/Splunk-Search/what-is-the-limit-to-the-number-of-categories-that-can-be-in-a/m-p/130307#M35499 HattrickNZ 2015-04-08T03:25:41Z https://community.splunk.com/t5/Splunk-Search/what-is-the-limit-to-the-number-of-categories-that-can-be-in-a/m-p/130308#M35500 <P>You may also find the docs on <A href="http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/timechart">timechart</A> useful. </P> <P>in particular <CODE>otherstr</CODE> can be used to rename Other.</P> Wed, 08 Apr 2015 04:40:34 GMT https://community.splunk.com/t5/Splunk-Search/what-is-the-limit-to-the-number-of-categories-that-can-be-in-a/m-p/130308#M35500 acharlieh 2015-04-08T04:40:34Z https://community.splunk.com/t5/Splunk-Search/what-is-the-limit-to-the-number-of-categories-that-can-be-in-a/m-p/130309#M35501 <P>Hi HattrickNZ<BR /> use limit=0 like below</P> <PRE><CODE> ... | timechart span=15m max(c84162281) as "Average Seizure Traffic per Line (Trunk Group)" by TG_Category limit=0 | eval threshold=1 </CODE></PRE> Wed, 08 Apr 2015 07:36:05 GMT https://community.splunk.com/t5/Splunk-Search/what-is-the-limit-to-the-number-of-categories-that-can-be-in-a/m-p/130309#M35501 chimell 2015-04-08T07:36:05Z https://community.splunk.com/t5/Splunk-Search/what-is-the-limit-to-the-number-of-categories-that-can-be-in-a/m-p/130310#M35502 <P>Alternatively, you can add <CODE>useother=f</CODE> if you don't want to see the "Other" category.</P> Wed, 08 Apr 2015 08:43:14 GMT https://community.splunk.com/t5/Splunk-Search/what-is-the-limit-to-the-number-of-categories-that-can-be-in-a/m-p/130310#M35502 jeffland 2015-04-08T08:43:14Z https://community.splunk.com/t5/Splunk-Search/what-is-the-limit-to-the-number-of-categories-that-can-be-in-a/m-p/130311#M35503 <P>Hi HattrickNZ ,<BR /> There is no limit for the number of categories that can be in legend in splunk timechart .<BR /> If you have 14 categories to show and it only shows 10, It is simply because splunk consider the value or the amount of the other categoties to be insignificant. <BR /> So splunk do not see an interest to put then in the legend But splunk gather all that values in one categories call <STRONG>other</STRONG> </P> <P>Note that you can decide to display all your legend values( see what Chimell proposed).</P> Wed, 08 Apr 2015 09:26:33 GMT https://community.splunk.com/t5/Splunk-Search/what-is-the-limit-to-the-number-of-categories-that-can-be-in-a/m-p/130311#M35503 stephane_cyrill 2015-04-08T09:26:33Z https://community.splunk.com/t5/Splunk-Search/what-is-the-limit-to-the-number-of-categories-that-can-be-in-a/m-p/130312#M35504 <P>try like this: <CODE>.. | timechart span=15m useother=f limit=0 max(c84162281) as "Average Seizure Traffic per Line (Trunk Group)" by TG_Category |...<BR /> </CODE></P> <P>to see the "Other" category <BR /> and for more information on timechart command see this link: docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/timechart</P> Wed, 08 Apr 2015 10:10:32 GMT https://community.splunk.com/t5/Splunk-Search/what-is-the-limit-to-the-number-of-categories-that-can-be-in-a/m-p/130312#M35504 fdi01 2015-04-08T10:10:32Z https://community.splunk.com/t5/Splunk-Search/what-is-the-limit-to-the-number-of-categories-that-can-be-in-a/m-p/130313#M35505 <P>tks but <CODE>useother=f</CODE> will remvoe it completely from the legend and this is not what i want in this instance but good to know.</P> Sun, 12 Apr 2015 23:04:07 GMT https://community.splunk.com/t5/Splunk-Search/what-is-the-limit-to-the-number-of-categories-that-can-be-in-a/m-p/130313#M35505 HattrickNZ 2015-04-12T23:04:07Z https://community.splunk.com/t5/Splunk-Search/what-is-the-limit-to-the-number-of-categories-that-can-be-in-a/m-p/130314#M35506 <P><CODE>limit=0</CODE> works by not grouping the remaining categories into <CODE>Other</CODE>. </P> Sun, 12 Apr 2015 23:05:02 GMT https://community.splunk.com/t5/Splunk-Search/what-is-the-limit-to-the-number-of-categories-that-can-be-in-a/m-p/130314#M35506 HattrickNZ 2015-04-12T23:05:02Z