Do you still have this issue? We've recently fixed set of issues related to CAPTCHA, so it should be all working now. Please email me at op@splunk.com if you are still seeing bad CAPTCHAs. ... View more

The timechart command has flags that you can give that will limit or expand the number of items tracked on the chart. If you want to eliminate other then there is a flag called "useother=f" and this will remove this bucketing. If you want to increase the default 10 items for the timechart then use the "limit= " flag. Here is an example: ... | timechart span=15m count by EventCode useother=f limit=20 Here is a link for more information: http://docs.splunk.com/Documentation/Splunk/4.3.3/SearchReference/Timechart ... View more