Dashboards & Visualizations

"Other" in timechart- How do I increase default limit to show all hosts?

nowplaying
Explorer

I've come across this problem before but can't find it in the answers site.

I have a timechart within in an advanced dashboard which I'm charting a value by host and it's only showing 10 valid hosts the remaining hosts are put into this "Other" value. How do I increase the this default limit to show all the my hosts.

Thanks

Labels (1)
Tags (1)

vrmandadi
Builder

Use this in your timechart command

| timechart count by usenull=f useother=f

cmerriman
Super Champion

if you put limit=0, there isn't a limit at all.

erez10121012
Path Finder

thanks

WORKD FOR ME

0 Karma

cmerriman
Super Champion

useother=f just leaves the 'other' field out of the results but still limits the amount of fields returned.

vijaykumartcs
Explorer

How do i remove other from the timechart..,How do i remove other from the timechart

0 Karma

nmaroulis_splun
Splunk Employee
Splunk Employee

The best way is to use useother=f with timechart
ex |timechart useother=f count by foobar

Stephen_Sorkin
Splunk Employee
Splunk Employee

You can use the "limit" argument to timechart:

... | timechart count by foo limit=20

or

... | timechart count by foo limit=100

sideview
SplunkTrust
SplunkTrust

And also if/when you do want it to only show the top N values but you do NOT want it to roll up everthing else under 'OTHER', you can pass useother="f" to timechart. ( http://www.splunk.com/base/Documentation/latest/SearchReference/Timechart )

Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...