Reporting

More "top values by time"

mburbidg
Explorer

From the search app after entering a query I can click on any field and generate a report called "Top values by time". It will generate a report listing the x top values of that field over time. But it only gives me some default of top values. For my example it is giving me the top 11. I need all values over time and I would like to export this to a spreadsheet.

How do I modify the report to give me all values over time and export that to a csv file?

I tried the following query

Metrics catalog index="production" | timechart count by title limit=500

I can execute this search. When I go to report and export to csv I get the following error:

This webpage is not found.

No webpage was found for the web address: http://splunk:8000/en-US/api/search/jobs/1295467350.221/results?isDownload=true&timeFormat=%25FT%25T...

More information on this error

If I set limit=350 I do not get the error. It seems like that valid max value of limit is somewhere around 400. But I would really like to get all values over time.

Thanks, Michael-

Tags (1)

Genti
Splunk Employee
Splunk Employee

you might want to try limit=0 as well. it works for me..

0 Karma

sideview
SplunkTrust
SplunkTrust

1) getting timechart count by foo to show more than 10 foo.

timechart count by foo limit=100

the limit param on timechart command defaults to 10. And it wraps up everything else as "OTHER". (If you dont want it to show other you can use another param useother=f ) http://www.splunk.com/base/Documentation/latest/SearchReference/Timechart

2) Sounds like a bug I'm afraid to say. I would try a different browser first. If that doesnt work and if you have shell access to the box (kind of a big IF these days), you can pipe your search to

<your search> | outputcsv your_filename and it'll create a csv file of all your results at $SPLUNK_HOME/var/run/splunk/filename.csv

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...