More "top values by time"

[mburbidg]

From the search app after entering a query I can click on any field and generate a report called "Top values by time". It will generate a report listing the x top values of that field over time. But it only gives me some default of top values. For my example it is giving me the top 11. I need all values over time and I would like to export this to a spreadsheet.

How do I modify the report to give me all values over time and export that to a csv file?

I tried the following query

Metrics catalog index="production" | timechart count by title limit=500

I can execute this search. When I go to report and export to csv I get the following error:

This webpage is not found.

No webpage was found for the web address: http://splunk:8000/en-US/api/search/jobs/1295467350.221/results?isDownload=true&timeFormat=%25FT%25T...

More information on this error

If I set limit=350 I do not get the error. It seems like that valid max value of limit is somewhere around 400. But I would really like to get all values over time.

Thanks, Michael-

[Genti]

you might want to try limit=0 as well. it works for me..

[sideview]

1) getting timechart count by foo to show more than 10 foo.

timechart count by foo limit=100

the limit param on timechart command defaults to 10. And it wraps up everything else as "OTHER". (If you dont want it to show other you can use another param useother=f ) http://www.splunk.com/base/Documentation/latest/SearchReference/Timechart

2) Sounds like a bug I'm afraid to say. I would try a different browser first. If that doesnt work and if you have shell access to the box (kind of a big IF these days), you can pipe your search to

<your search> | outputcsv your_filename and it'll create a csv file of all your results at $SPLUNK_HOME/var/run/splunk/filename.csv