Tables, Charts, and Fields - Implementing Splunk: Big Data Reporting and Development for Operational Intelligence - page 59

timechart options
timechart has many arguments and formatting options. We'll touch upon a few
examples of formatting, but they are too numerous to cover in detail. We will use
other chart types in later chapters. Let's throw a few options in and see what they do.
timechart bins=100 limit=3 useother=false usenull=false
count as "Error count" by user
Let's step through each of these arguments:
• bins defines how many "bins" to slice time into. The number of bins
will probably not be exactly 100 as the time will be sliced into logical
units. In our example, this comes to 10 minutes per bin. To be more exact,
you can use span (for example, span=1h ) for hourly slices, but note that if
your span value creates too many time slices, the chart will be truncated.
• limit changes the number of series returned. The series with the largest
values are returned, much like in top . In this case, the most common values
of user will be returned.
• useother instructs timechart whether to group all series beyond the limit
into an "other" bucket. The default value is true .
• usenull instructs timechart whether to bucket, into the group NULL ,
events that do not have a value for the fields in the by clause. The default
value is true .
This combination of arguments produces a graph similar to this: