Dashboards & Visualizations

"Other" in timechart- How do I increase default limit to show all hosts?

nowplaying
Explorer

I've come across this problem before but can't find it in the answers site.

I have a timechart within in an advanced dashboard which I'm charting a value by host and it's only showing 10 valid hosts the remaining hosts are put into this "Other" value. How do I increase the this default limit to show all the my hosts.

Thanks

Tags (1)

vrmandadi
Builder

Use this in your timechart command

| timechart count by usenull=f useother=f

cmerriman
Super Champion

if you put limit=0, there isn't a limit at all.

erez10121012
Path Finder

thanks

WORKD FOR ME

0 Karma

cmerriman
Super Champion

useother=f just leaves the 'other' field out of the results but still limits the amount of fields returned.

vijaykumartcs
Explorer

How do i remove other from the timechart..,How do i remove other from the timechart

0 Karma

nmaroulis_splun
Splunk Employee
Splunk Employee

The best way is to use useother=f with timechart
ex |timechart useother=f count by foobar

Stephen_Sorkin
Splunk Employee
Splunk Employee

You can use the "limit" argument to timechart:

... | timechart count by foo limit=20

or

... | timechart count by foo limit=100

sideview
SplunkTrust
SplunkTrust

And also if/when you do want it to only show the top N values but you do NOT want it to roll up everthing else under 'OTHER', you can pass useother="f" to timechart. ( http://www.splunk.com/base/Documentation/latest/SearchReference/Timechart )

Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...