Using a timechart, why are all the results not being shown on the dashboard?

[alanxu]

The search I am using is

host=... source = ... SP | timechart latest(TIME) as Completion_Time by BeginName | eval Completion_Time=tonumber(replace(Completion_Time,"(\d+):(\d+):(\d+)","\1.\2"))

So for BeginName there should have 26 different names, but on my dashboard, I only have 10 names. I was wondering if it's because all the names wouldn't fit?

[alacercogitatus · Accepted solution]

Yes, by default timechart only shows 10 from the by clause. You can change it like this:

| timechart limit=25 latest(TIME) as Completion_Time by BeginName

You can also remove the NULL and OTHER fields, using the options outlined here: http://docs.splunk.com/Documentation/Splunk/6.2.5/SearchReference/timechart

[acharlieh]

This is where the limit argument to timechart is useful to know, the others are included in the "OTHER" column. Splunk has a default of 10 here because often timechart is displayed in a graph, and as the number of series grows, it takes more and more to display (and if you have too many distinct series it may not even display correctly). But if you want to ensure that you have all series, just change:

| timechart latest(TIME) as Completion_Time by BeginName

to:

| timechart limit=0 latest(TIME) as Completion_Time by BeginName

As you're doing a latest instead of some of the other stats functions out there, I'm not sure what your source data is, but you may also be interested in the xyseries command to turn rows of data into a tabular format.

[alanxu]

Thank you for your help

[alanxu]

Your answer was great I just chose the earlier one because it was similar