https://community.splunk.com/t5/Dashboards-Visualizations/remove-element-from-a-chart/m-p/71499#M3873 <P>Just remove the eventtype 'unix-all-logs' from your base search.</P> <PRE><CODE>sourcetype=cisco_syslog AND NOT eventtype="unix-all-logs" | top limit=0 eventtype </CODE></PRE> Wed, 04 May 2011 21:54:24 GMT Ayn 2011-05-04T21:54:24Z https://community.splunk.com/t5/Dashboards-Visualizations/remove-element-from-a-chart/m-p/71498#M3872 <P>hi, i'm trying to get a simple pie chart of all my eventtypes for my dash board; the problem is that we currently have all log entries come in with the eventtype 'unix-all-logs'; which means not only am i double counting, but also has a rather large (50%) slice for the unix-add-logs.</P> <P>is there a way i can remove just that entry from the output? or do i have to persuade who ever to not apply that eventtype to everything?</P> <PRE><CODE>sourcetype=cisco_syslog | top limit=0 eventtype </CODE></PRE> Thu, 31 Mar 2011 08:31:59 GMT https://community.splunk.com/t5/Dashboards-Visualizations/remove-element-from-a-chart/m-p/71498#M3872 ytl 2011-03-31T08:31:59Z https://community.splunk.com/t5/Dashboards-Visualizations/remove-element-from-a-chart/m-p/71499#M3873 <P>Just remove the eventtype 'unix-all-logs' from your base search.</P> <PRE><CODE>sourcetype=cisco_syslog AND NOT eventtype="unix-all-logs" | top limit=0 eventtype </CODE></PRE> Wed, 04 May 2011 21:54:24 GMT https://community.splunk.com/t5/Dashboards-Visualizations/remove-element-from-a-chart/m-p/71499#M3873 Ayn 2011-05-04T21:54:24Z https://community.splunk.com/t5/Dashboards-Visualizations/remove-element-from-a-chart/m-p/71500#M3874 <P>He indicated that every log entry comes in with that eventtype, so won't this exclude all entries?</P> Tue, 15 Jul 2014 20:22:35 GMT https://community.splunk.com/t5/Dashboards-Visualizations/remove-element-from-a-chart/m-p/71500#M3874 DNewfield 2014-07-15T20:22:35Z