Splunk Search
Highlighted

Why am I getting chart error "The following options were specified but have no effect when a split-by clause is not provided:limit"?

Engager

I'm trying to chart the top hits to a search while the rest are rolled up into an 'OTHER' column. Ideally I'd like the split to be based on a threshold value, otherwise setting the number of columns is fine. I've read through the docs on the chart function, tried a whole host of stuff, but I cannot get it right. One of the errors I keep getting is:

The following options were specified but have no effect when a split-by clause is not provided:limit

I also tried to set the wherethresh-comp parameter in chart function, but I'm not sure of the syntax and I couldn't get it to work either.

This is the search command I'm using:

* | regex "\b[AC]\d{6,8}\b" | rex "\b(?<emp_number>[AC]\d{6,8})\b" | chart count by emp_number
0 Karma
Highlighted

Re: Why am I getting chart error "The following options were specified but have no effect when a split-by clause is not provided:limit"?

Legend

You need one for field - for example .. | chart limit=2 count over index by emp_number I'm using index only to give you an idea of why you're getting the error message.

0 Karma