https://community.splunk.com/t5/Splunk-Search/how-to-remove-other-values/m-p/380248#M170473 <P>how to remove other values from this search syntax</P> <P>index=main sourcetype=access_combined_wcookie productId<BR /> | chart count by clientip | iplocation clientip <BR /> | geostats count by clientip globallimit=5</P> Wed, 30 Sep 2020 01:15:09 GMT mkhedr 2020-09-30T01:15:09Z https://community.splunk.com/t5/Splunk-Search/how-to-remove-other-values/m-p/380248#M170473 <P>how to remove other values from this search syntax</P> <P>index=main sourcetype=access_combined_wcookie productId<BR /> | chart count by clientip | iplocation clientip <BR /> | geostats count by clientip globallimit=5</P> Wed, 30 Sep 2020 01:15:09 GMT https://community.splunk.com/t5/Splunk-Search/how-to-remove-other-values/m-p/380248#M170473 mkhedr 2020-09-30T01:15:09Z https://community.splunk.com/t5/Splunk-Search/how-to-remove-other-values/m-p/380249#M170474 <P>Hi mkhedr,</P> <P>the docs of <CODE>geostats</CODE> <A href="https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Geostats#Optional_arguments">https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Geostats#Optional_arguments</A> say this:</P> <PRE><CODE>globallimit Syntax: globallimit=&lt;int&gt; Description: Controls the number of named categories to add to each pie chart. There is one additional category called "OTHER" under which all other split-by values are grouped. Setting globallimit=0 removes all limits and all categories are rendered. Currently the grouping into "OTHER" only works intuitively for count and additive statistics. Default: 10 </CODE></PRE> <P>Run the same search with <CODE>| geostats count by clientip globallimit=0</CODE> and the <EM>other</EM> group is no longer available.</P> <P>Hope this helps ...</P> <P>cheers, MuS</P> Sun, 07 Jul 2019 22:50:10 GMT https://community.splunk.com/t5/Splunk-Search/how-to-remove-other-values/m-p/380249#M170474 MuS 2019-07-07T22:50:10Z