Splunk Search
Highlighted

How to edit my search to convert epoch _time headers and display all columns instead of combining some results as "Other"?

Path Finder

Hi

This is my current search:

chart count(TYPE) over TYPE by _time

I only get 10-12 columns, the rest is put in Other.
All columns are headed with the epoch start of day. Is it possible to get this as strptime() with unlimited columns?

thanks

0 Karma
Highlighted

Re: How to edit my search to convert epoch _time headers and display all columns instead of combining some results as "Other"?

Path Finder

Sorry I meant unlimited collumns, not rows (which is controlled with limit=0)

0 Karma
Highlighted

Re: How to edit my search to convert epoch _time headers and display all columns instead of combining some results as "Other"?

Influencer

You want the time field to be the columns? Eval _time in to a new field, like in this run anywhere example:

index=_internal earliest=-1m  
| eval time=strftime(_time,"%Y/%m/%d %H:%M:%S") 
| chart limit=0 count(sourcetype) over sourcetype by time

If you want to mimic the span argument to timechart, and aggregate the time ranges you are using for columns, you can use bin first, like so:

index=_internal earliest=-1m  
| bin _time span=10s 
| eval time=strftime(_time,"%Y/%m/%d %H:%M:%S") 
| chart limit=0 count(sourcetype) over sourcetype by time

View solution in original post

Highlighted

Re: How to edit my search to convert epoch _time headers and display all columns instead of combining some results as "Other"?

Path Finder

Thanks jplumsdaine22, Worked like a dream.

0 Karma