Dashboards & Visualizations

Visualization limit

arkonner
Path Finder

with the search below I identify the account locked-out - I am using "column chart" output and under visualization format there is no limit but as result only ten Account names are displayed. I have no idea where this limit has been introduced and I need to display all Account locked-out

Thank you in advance for the attention given

index=wineventlog source="WinEventLog:Security" sourcetype="WinEventLog:Security" Account_Name="*" EventCode=4740 OR EventCode=644 AND Account_Name!=Guest AND Account_Name!=Administrator AND Account_Name!=Anonymous | eval Account_Name = mvindex(Account_Name,1) | eval Security_ID = mvindex(Security_ID,1) | timechart span=1h useother=f count by Account_Name

0 Karma
1 Solution

sundareshr
Legend

Try this

index=wineventlog source="WinEventLog:Security" sourcetype="WinEventLog:Security" Account_Name="*" EventCode=4740 OR EventCode=644 AND Account_Name!=Guest AND Account_Name!=Administrator AND Account_Name!=Anonymous | eval Account_Name = mvindex(Account_Name,1) | eval Security_ID = mvindex(Security_ID,1) | timechart limit=0 span=1h useother=f count by Account_Name

View solution in original post

0 Karma

sundareshr
Legend

Try this

index=wineventlog source="WinEventLog:Security" sourcetype="WinEventLog:Security" Account_Name="*" EventCode=4740 OR EventCode=644 AND Account_Name!=Guest AND Account_Name!=Administrator AND Account_Name!=Anonymous | eval Account_Name = mvindex(Account_Name,1) | eval Security_ID = mvindex(Security_ID,1) | timechart limit=0 span=1h useother=f count by Account_Name
0 Karma

davebrooking
Contributor

The timechart command has a limit option, I thought the default was documented, but don't see it in the docs. This earlier answer states the default is 10.

Dave

0 Karma

JDukeSplunk
Builder

Yep like Dave said there is a limit=X option for timechart. Timechart can be a bear to display properly. Depending on the time range the search is run in, I often have to slice it into bigger slices using span= as well as limit.

So. If you're doing a 30 day search your timechart might look like this to get the top 50 accounts per day.

 | timechart span=1d useother=f  limit=50 count by Account_Name 
0 Karma

arkonner
Path Finder

Thank you Dave

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...