topic [Need Help] how to expand 'OTHER' column created by stats command in Splunk Search

[Need Help] how to expand 'OTHER' column created by stats command

cheriemilk — Thu, 08 Oct 2020 14:39:09 GMT

Hi team,

when I use stats command to group and aggregration. For example:

<base query here>
| bin span=1d _time
| stats count(eval(autosave=1)) as autosave
count(eval(autosave=0 OR autosave=1)) as total by _time, DC .

There's a column named 'OTHER' created. I want all the columns displayed, instead of group into 'OTHER' column if the number of columns are many.

I know that for timechart command there's a parameter useother=false can do this. but I can't find asuch a paramter for stats command , can you help?

Re: [Need Help] how to expand 'OTHER' column created by stats command

richgalloway — Thu, 08 Oct 2020 17:31:51 GMT

The stats command does NOT produce a field called "OTHER". The only fields returned by stats are those named ("autosave", "total", "_time", and "DC" in the example query) in the command.

Re: [Need Help] how to expand 'OTHER' column created by stats command

cheriemilk — Fri, 09 Oct 2020 00:47:57 GMT

Hi @richgalloway

Sorry that i was just awared that the 'OTHER' column is created by chart command, instead of stats.

| stats count(eval(autosave=1)) as autosave count(eval(autosave=0 OR autosave=1)) as total by _time , DC
| eval percent=round(autosave * 100 / total,2)
| chart values(total) as total values(autosave) as autosave values(percent) as percent by _time , DC

How to expand 'OTHER' column?

Thanks,

Cherie

Re: [Need Help] how to expand 'OTHER' column created by stats command

cheriemilk — Fri, 09 Oct 2020 00:51:21 GMT

Hi @richgalloway

I found this useother=false can applied to chart command as well, just like timechart command.

Thanks.

Re: [Need Help] how to expand 'OTHER' column created by stats command

richgalloway — Fri, 09 Oct 2020 12:35:35 GMT

The chart command has a useother option.

| chart useother=f values(total) as total values(autosave) as autosave values(percent) as percent by _time , DC