Splunk Search

Why am I getting chart error "The following options were specified but have no effect when a split-by clause is not provided:limit"?

JonoCoetzee
Engager

I'm trying to chart the top hits to a search while the rest are rolled up into an 'OTHER' column. Ideally I'd like the split to be based on a threshold value, otherwise setting the number of columns is fine. I've read through the docs on the chart function, tried a whole host of stuff, but I cannot get it right. One of the errors I keep getting is:

The following options were specified but have no effect when a split-by clause is not provided:limit

I also tried to set the wherethresh-comp parameter in chart function, but I'm not sure of the syntax and I couldn't get it to work either.

This is the search command I'm using:

* | regex "\b[AC]\d{6,8}\b" | rex "\b(?<emp_number>[AC]\d{6,8})\b" | chart count by emp_number
0 Karma

sundareshr
Legend

You need one for field - for example .. | chart limit=2 count over index by emp_number I'm using index only to give you an idea of why you're getting the error message.

0 Karma
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! &#x1f308; In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...