Archive
Highlighted

Changes in timechart useother functionality in 4.2?

Path Finder

We used to have a dashboard driven by a simple query that would show a value per hour for all of our index servers.

* | timechart span=1h count by splunk_server useother=f

Before we upgraded to 4.2 this would work as we had come to expect it, but now it only shows the top 10 servers. If we drop useother=f it will then show an "other" column along with the top 10, but we want all splunk_server values. Is there a new way to do this?

Thanks, Kevin

0 Karma
Highlighted

Re: Changes in timechart useother functionality in 4.2?

Splunk Employee
Splunk Employee

I'm pretty sure that's how it has always behaved. To get more series, you need to use the limit argument like:

* | timechart span=1h count by splunk_server limit=100

View solution in original post

Highlighted

Re: Changes in timechart useother functionality in 4.2?

Path Finder

Thank you Stephen 🙂 useother=f used to work, just not sure if it was intended to do what I wanted. Either way, limit=100 works perfectly, thank you sir.

0 Karma