How to edit my search to convert epoch _time headers and display all columns instead of combining some results as "Other"?

[mortenb123]

Hi

This is my current search:

chart count(TYPE) over TYPE by _time

I only get 10-12 columns, the rest is put in Other.
All columns are headed with the epoch start of day. Is it possible to get this as strptime() with unlimited columns?

thanks

[jplumsdaine22 · Accepted solution]

You want the time field to be the columns? Eval _time in to a new field, like in this run anywhere example:

index=_internal earliest=-1m  
| eval time=strftime(_time,"%Y/%m/%d %H:%M:%S") 
| chart limit=0 count(sourcetype) over sourcetype by time

If you want to mimic the span argument to timechart, and aggregate the time ranges you are using for columns, you can use bin first, like so:

index=_internal earliest=-1m  
| bin _time span=10s 
| eval time=strftime(_time,"%Y/%m/%d %H:%M:%S") 
| chart limit=0 count(sourcetype) over sourcetype by time

[mortenb123]

Thanks jplumsdaine22, Worked like a dream.

[mortenb123]

Sorry I meant unlimited collumns, not rows (which is controlled with limit=0)