Splunk Search

## what is the limit to the number of categories that can be in a legend in splunk timechart

Motivator

I have a timechart search that looks something like:

... | timechart  span=15m max(c84162281) as "Average Seizure Traffic per Line (Trunk Group)" by TG_Category | eval threshold=1

Some Observations/Questions:
But there is 14 categories to show and it only shows 10, and puts the remaining categories into Other. So that's 11 categories in total showing.
The legend seems to show the categories in alphabetical order. Can I order this by size or something else other that alphabetically?
Can I name Other to something else?
I can add another category to the legend using the eval threshold=1 and this seems to appear in the legend. So there is a limit there of sorts, but not completely it seems

Tags (3)
1 Solution
Motivator

Hi HattrickNZ
use limit=0 like below

... | timechart span=15m  max(c84162281) as "Average Seizure Traffic per Line (Trunk Group)" by TG_Category   limit=0 | eval threshold=1
Motivator

try like this: .. | timechart span=15m useother=f limit=0 max(c84162281) as "Average Seizure Traffic per Line (Trunk Group)" by TG_Category |...

to see the "Other" category

Builder

Hi HattrickNZ ,
There is no limit for the number of categories that can be in legend in splunk timechart .
If you have 14 categories to show and it only shows 10, It is simply because splunk consider the value or the amount of the other categoties to be insignificant.
So splunk do not see an interest to put then in the legend But splunk gather all that values in one categories call other

Note that you can decide to display all your legend values( see what Chimell proposed).

Motivator

Hi HattrickNZ
use limit=0 like below

... | timechart span=15m  max(c84162281) as "Average Seizure Traffic per Line (Trunk Group)" by TG_Category   limit=0 | eval threshold=1
SplunkTrust

Alternatively, you can add useother=f if you don't want to see the "Other" category.

Motivator

tks but useother=f will remvoe it completely from the legend and this is not what i want in this instance but good to know.

Motivator

limit=0 works by not grouping the remaining categories into Other.

Influencer

You may also find the docs on timechart useful.

in particular otherstr can be used to rename Other.

Motivator

found this re the limit question

Get Updates on the Splunk Community!

#### Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

#### Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

#### Adoption of RUM and APM at Splunk

Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...