topic Re: Is there a timechart legend limit? in Splunk Search

Is there a timechart legend limit?

RVDowning — Wed, 25 Mar 2015 19:05:35 GMT

I have the following in a search

| timechart span=1h max(CPU%) AS "CPU", max(Memory%) as "MEM" by host

If the number of hosts is 10 or fewer, it works as expected. If there are 11 hosts, the hostname is shown as "OTHER." Is this a built in limit? If so, can this limit be extended?

Re: Is there a timechart legend limit?

masonmorales — Thu, 26 Mar 2015 05:03:21 GMT

Try:

| timechart span=1h max(CPU%) AS "CPU", max(Memory%) as "MEM" by host useother=f limit=100

Re: Is there a timechart legend limit?

chimell — Thu, 26 Mar 2015 12:49:30 GMT

Hi RVDowing

use limit=0 means no filtering

 ......| timechart span=1h max(CPU%) AS "CPU", max(Memory%) as "MEM" by host limit=0

Thanks

Re: Is there a timechart legend limit?

masonmorales — Thu, 26 Mar 2015 17:41:27 GMT

You can also do useother=f limit=0 for no filtering. useother=f disables aggregation of all other data that exceeds the limit specified. Please click accept answer if this was helpful.

Re: Is there a timechart legend limit?

sssignals — Tue, 26 Sep 2017 15:35:17 GMT

It works! Thanks.