timechart function issue

[prathapkcsc]

Hi everyone,
my query look like this
base search | reg " " | | bin _time as desired_times span=4h
| table _time server CPU MEM DISK raw1 raw2

This query working perfectly, giving desired results.
But after adding "| timechart max(DISK) as DISK by server" , its giving me all servers except two servers, meanwhile it was giving me the new column named as "OTHERS" which is not existed in my data.
Can anyone explain about this?

[dineshraj9]

You need to use the limit attribute and all the servers would be listed -
http://docs.splunk.com/Documentation/Splunk/6.6.0/SearchReference/Timechart

| timechart limit=0 max(DISK) as DISK by server

[prathapkcsc]

base search | reg " " | | bin _time as desired_times span=4h | | where _time = desired_times
| table _time server CPU MEM DISK raw1 raw2.

In where_time=desired_times,
my desired timings are 8AM,12PM,18PM.
How to give all 3 timings in that where clause

[dineshraj9]

If you are wanting to search for events only during these hours, then use the date_hour field before the table command.

| search date_hour=8 OR date_hour=12 OR date_hour=18

To get events during these hours.

[prathapkcsc]

Awesome mate..
Thank you somuch..worked perfectly