Dashboards & Visualizations

"Other" in timechart- How do I increase default limit to show all hosts?

nowplaying
Explorer

I've come across this problem before but can't find it in the answers site.

I have a timechart within in an advanced dashboard which I'm charting a value by host and it's only showing 10 valid hosts the remaining hosts are put into this "Other" value. How do I increase the this default limit to show all the my hosts.

Thanks

Tags (1)

vrmandadi
Builder

Use this in your timechart command

| timechart count by usenull=f useother=f

cmerriman
Super Champion

if you put limit=0, there isn't a limit at all.

erez10121012
Path Finder

thanks

WORKD FOR ME

0 Karma

cmerriman
Super Champion

useother=f just leaves the 'other' field out of the results but still limits the amount of fields returned.

vijaykumartcs
Explorer

How do i remove other from the timechart..,How do i remove other from the timechart

0 Karma

nmaroulis_splun
Splunk Employee
Splunk Employee

The best way is to use useother=f with timechart
ex |timechart useother=f count by foobar

Stephen_Sorkin
Splunk Employee
Splunk Employee

You can use the "limit" argument to timechart:

... | timechart count by foo limit=20

or

... | timechart count by foo limit=100

sideview
SplunkTrust
SplunkTrust

And also if/when you do want it to only show the top N values but you do NOT want it to roll up everthing else under 'OTHER', you can pass useother="f" to timechart. ( http://www.splunk.com/base/Documentation/latest/SearchReference/Timechart )

Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...