Splunk Search

How do I make a timechart show the times in horizontal instead of vertical?

New Member

I am trying to run a search that shows how many unique ports a particular IP address access in a day over a seven pay period

I am using the following search:

index=***** | timechart span=1d dc(dest_port) by src_ip

This seems to get me the correct information, but it would be a lot more useful if I could have the time as the header and the list of IP's going vertical. This way I could see a lot more information. The current search only shows me 10 IP addresses and groups the rest into an "OTHER" column.


0 Karma


You should use "useother" option.

index=* | timechart span=1d dc(dest_port) by src_ip useohter=false

index=* | timechart span=1d dc(dest_port) by src_ip | sort 100

Good day!

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>