how does "Other" get calculated in a timechart?

[dang]

I've got a splunk query like the following:

...| timechart span=10m max(CurrentAnonymousUsers) by ComputerName

Because there are more than 20 distinct computer names, when I graph the data, there is a column titled "Other" and then some of the other distinct names. How does this "Other" column get calculated? I assume it's an average of the lower n values or something? Is there some way to modify the number of items that are included in "Other"?

[sideview · Accepted solution]

it will calculate the top values for the particular metric overall. So in this case the 10 should be the 10 ComputerName values that had the highest max(CurrentAnonymousUsers).

If you want to increase it from the default of 10, you use the limit keyword, like to have it display the top 50 and roll up the rest into "other":

...| timechart span=10m limit=50 max(CurrentAnonymousUsers) by ComputerName

the docs explain this as well although the examples don't include an example of limit.

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/timechart