chart legend properties

[splunkpoornima]

Hi all,

i created the the trend chart for my Task Manager log files ...some of the Task are showed in legend and remaining Tasks are grouped as OTHER ,..

How it groups the Task and put it in OTHER or it has any criteria so that it groups the Task

Plz clarify me

Thanks
poornima

[lguinn2 · Accepted solution]

It would help if you actually showed the search.

But I will try to explain in the abstract. If I run a search like this

somesearch | timechart count by task

Splunk will only graph the 10 tasks that appear most frequently. The remaining tasks will be grouped into a category named "OTHER" by default. There are options for removing the OTHER category, as well as other actions you could take to group or eliminate categories. to eliminate OTHER

somesearch | timechart useother=f count by task

Read the entry for the timechart command in the Search Reference Manual for more options.