Chart command is limited to 10000 results by default, but I want to see all the events (Total-73228 events).
index=edi-stage date_wday=monday|eval _time=_time+14400|table _time date_month date_wday date_mday CUSTOMERPO |eval time=strftime(_time,"%m/%d")|sort time |chart count(CUSTOMERPO) by time date_wday |
The limit is not in the chart command, it in the sort command. If the first argument to the sort command is a number, then at most that many results are returned, in order. If no number is specified, the default limit of 10000 is used. If the number 0 is specified, all results are returned
The limit is not in the chart command, it in the sort command. If the first argument to the sort command is a number, then at most that many results are returned, in order. If no number is specified, the default limit of 10000 is used. If the number 0 is specified, all results are returned