I have the following in a search
| timechart span=1h max(CPU%) AS "CPU", max(Memory%) as "MEM" by host
If the number of hosts is 10 or fewer, it works as expected. If there are 11 hosts, the hostname is shown as "OTHER." Is this a built in limit? If so, can this limit be extended?
You can also do useother=f limit=0 for no filtering. useother=f disables aggregation of all other data that exceeds the limit specified. Please click accept answer if this was helpful.