topic Re: drilldown OTHER in a chart in Dashboards & Visualizations

drilldown OTHER in a chart

wsw70 — Fri, 17 Feb 2012 16:29:51 GMT

Hello,

I have a bar chart created from the following search:

eventtype="EVENT_OSCE_Virus" | dedup Virus, destination | timechart count by Virus

The idea was to get a stacked bar chart of viral activity for the past week. It works fine, the chart is correct. I can also drill down by clicking on a virus name on the legend, or the relevant stack layer on the chart.

All this except for the automatically created OTHER category which groups the remaining events. When clicking on it I get the search

eventtype="EVENT_OSCE_Virus" | dedup Virus, destination | search Virus="OTHER"

which is obviously wrong. It should rather be something like

eventtype="EVENT_OSCE_Virus" | dedup Virus, destination | search NOT (Virus="first virus in 
the legend" OR Virus="second virus in the legend" ...)

Is there a way to modify the default behavior for this kind of drilldown (ie. for a drilldown which uses the OTHER category)?

Thank you.

Re: drilldown OTHER in a chart

Ant1D — Tue, 21 Feb 2012 10:34:54 GMT

Hi,

You cannot drilldown on the OTHER field and my understanding is that you cannot modify the behaviour of this field. If you want to see what exactly is going into your OTHER category for drilldown purposes, you can change your search to the following:

eventtype="EVENT_OSCE_Virus" | dedup Virus, destination | timechart limit=50 count by Virus

The limit=50 inclusion will show the top 50 Virus values. After those top 50 values are shown, it will place the remaining values (if there are more than 50 results) into the OTHER field. You can increase or decrease the limit value to your liking.

Re: drilldown OTHER in a chart

wsw70 — Tue, 21 Feb 2012 10:38:51 GMT

Thanks - this is what I was afraid of. I was hoping somehow that OTHER could be tweaked to display "everything except the values shown"