Dashboards & Visualizations

Using a timechart, why are all the results not being shown on the dashboard?

alanxu
Communicator

alt text

The search I am using is

host=... source = ... SP | timechart latest(TIME) as Completion_Time by BeginName | eval Completion_Time=tonumber(replace(Completion_Time,"(\d+):(\d+):(\d+)","\1.\2"))

So for BeginName there should have 26 different names, but on my dashboard, I only have 10 names. I was wondering if it's because all the names wouldn't fit?

Tags (2)
0 Karma
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

Yes, by default timechart only shows 10 from the by clause. You can change it like this:

| timechart limit=25 latest(TIME) as Completion_Time by BeginName

You can also remove the NULL and OTHER fields, using the options outlined here: http://docs.splunk.com/Documentation/Splunk/6.2.5/SearchReference/timechart

View solution in original post

alacercogitatus
SplunkTrust
SplunkTrust

Yes, by default timechart only shows 10 from the by clause. You can change it like this:

| timechart limit=25 latest(TIME) as Completion_Time by BeginName

You can also remove the NULL and OTHER fields, using the options outlined here: http://docs.splunk.com/Documentation/Splunk/6.2.5/SearchReference/timechart

acharlieh
Influencer

This is where the limit argument to timechart is useful to know, the others are included in the "OTHER" column. Splunk has a default of 10 here because often timechart is displayed in a graph, and as the number of series grows, it takes more and more to display (and if you have too many distinct series it may not even display correctly). But if you want to ensure that you have all series, just change:

| timechart latest(TIME) as Completion_Time by BeginName

to:

| timechart limit=0 latest(TIME) as Completion_Time by BeginName

As you're doing a latest instead of some of the other stats functions out there, I'm not sure what your source data is, but you may also be interested in the xyseries command to turn rows of data into a tabular format.

alanxu
Communicator

Thank you for your help

0 Karma

alanxu
Communicator

Your answer was great I just chose the earlier one because it was similar

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...