topic Re: useother=f in a pie chart in Dashboards & Visualizations

"useother=f" in a pie chart

tven7 — Mon, 28 Sep 2020 09:51:49 GMT

how do you get rid of this in pie charts pleas? I see OTHER take up a big piece of the pie right now in my search.

index=xyz exception | stats count(exception_message) by exception_message

Re: useother=f in a pie chart

gkanapathy — Thu, 01 Sep 2011 22:41:44 GMT

You have to use chart instead of stats.

Re: useother=f in a pie chart

lguinn2 — Mon, 28 Sep 2020 09:52:14 GMT

So the command is

index=xyz exception | chart count(exception_message) by exception_message useother=f

Re: useother=f in a pie chart

tven7 — Fri, 23 Sep 2011 22:00:59 GMT

thank you.

Re: useother=f in a pie chart

Dark_Ichigo — Tue, 29 May 2012 06:51:03 GMT

This doesnt work for me, no matter what I do it will always display the Other field only on the Pie Chart and not as a Field in the results.

Im using Splunk V4.3.2, is there a fix for this?

Re: useother=f in a pie chart

rogerdpack — Thu, 01 Nov 2012 19:19:21 GMT

You may be able to add "NOT index=OTHER" to the search criteria.

having useother=f works for me here, though.

I also was seeing NULL entries and added "AND index=*" to get rid of them.

Re: useother=f in a pie chart

lguinn2 — Fri, 02 Nov 2012 15:22:06 GMT

NOT index=OTHER

will not work unless there is actually an index named "OTHER"

Re: useother=f in a pie chart

darlas — Tue, 09 Dec 2014 22:12:51 GMT

I have this same issue with Pie chart. I'm using Splunk 6.2. usenull=f with Chart command still shows "other" slice. And the Not index=OTHER gives syntax errors. Any ideas?

Re: useother=f in a pie chart

lycollicott — Wed, 25 Oct 2017 19:44:50 GMT

A version 7.0 answer for anyone searching in 2017+

In addition to useother=false set a Minimum Size of 0 in Format:

Re: useother=f in a pie chart

wdelaronde — Mon, 21 Oct 2019 20:35:01 GMT

In your chart the syntax would look like this:
| chart useother=f usenull=f

Re: useother=f in a pie chart

ravikanthbadugu — Thu, 24 Oct 2019 15:23:38 GMT

I tried making minimum size to 0 and that worked.

Thank you.

Re: useother=f in a pie chart

GavinDSPLUNK — Thu, 18 Jun 2020 13:24:59 GMT

Thanks, you just helped a noob from losing his mind!