configure the timechart to not aggregate any elements into "other"

[alboucq]

when creating a timechart, it contains a maximum of 10 elements (lines, bars, etc) + one "other". The elements that are aggregated in "other" are those that have the lowest count. In my particular case, I am very interested in those elements. How can I configure the timechart to display all (or at least more of) the elements? Also, when I select the "other" category in the legend, splunk displays an empty timechart because it can't find any log entries whose element value is actually "other". How can I see those elements that have been aggregated?

[tgow]

The timechart command has flags that you can give that will limit or expand the number of items tracked on the chart. If you want to eliminate other then there is a flag called "useother=f" and this will remove this bucketing. If you want to increase the default 10 items for the timechart then use the "limit=" flag. Here is an example:

... | timechart span=15m count by EventCode useother=f limit=20

Here is a link for more information:

http://docs.splunk.com/Documentation/Splunk/4.3.3/SearchReference/Timechart