topic I have a timechart trying create a dashboard a value by host and it's only showing 10 valid hosts the remaining hosts are put into this "Other" value.. How do i remove "Other" from the dashboard? in Dashboards & Visualizations

I have a timechart trying create a dashboard a value by host and it's only showing 10 valid hosts the remaining hosts are put into this "Other" value.. How do i remove "Other" from the dashboard?

vijaykumartcs — Wed, 12 Oct 2016 11:09:16 GMT

I have a timechart trying create a dashboard a value by host and it's only showing 10 valid hosts the remaining hosts are put into this "Other" value.. How do i remove "Other" from the dashboard?

Re: I have a timechart trying create a dashboard a value by host and it's only showing 10 valid hosts the remaining hosts are put into this "Other" value.. How do i remove "Other" from the dashboard?

DEAD_BEEF — Wed, 12 Oct 2016 14:49:38 GMT

Try useother=f

Re: I have a timechart trying create a dashboard a value by host and it's only showing 10 valid hosts the remaining hosts are put into this "Other" value.. How do i remove "Other" from the dashboard?

hunters_splunk — Wed, 12 Oct 2016 15:11:31 GMT

Hi vijiaykumartcs,

To remove "other" values, please set the useother attribute to false in your query. Here's an example:

sourcetype=access_* action=purchase | timechart count by product usenull=f useother=f

You can also set usenull=f to filter out null values.
Hope it helps. Thanks!
Hunter Shen

Re: I have a timechart trying create a dashboard a value by host and it's only showing 10 valid hosts the remaining hosts are put into this "Other" value.. How do i remove "Other" from the dashboard?

hunters_splunk — Wed, 12 Oct 2016 15:16:42 GMT

Sorry for the typo - there shoud not be an asterisk at the end. Here is the corrected example query:

sourcetype=access_ action=purchase | timechart count by product usenull=f useother=f