topic Re: Top 10 Customers - exclude OTHER in Splunk Search

Top 10 Customers - exclude OTHER

ehaque — Sat, 18 Jul 2015 21:55:53 GMT

I use below spl to get top 10 cust by sales, but looks like it is creating a OTHER category whcih i dont want to visualize in graph. How can i exclude it? OTHER is not in the data.

source="swerve_sales.csv" host="swerve" sourcetype="csv-sales" | timechart sum(TOTAL) as sales by FIRSTNAME | sort - sales | head 10

Re: Top 10 Customers - exclude OTHER

pradeepkumarg — Sat, 18 Jul 2015 21:59:24 GMT

try below

source="swerve_sales.csv" host="swerve" sourcetype="csv-sales" | timechart limit=10 sum(TOTAL) as sales by FIRSTNAME

Re: Top 10 Customers - exclude OTHER

somesoni2 — Sat, 18 Jul 2015 22:52:01 GMT

Try something like this

source="swerve_sales.csv" host="swerve" sourcetype="csv-sales" | timechart sum(TOTAL) as sales by FIRSTNAME useother=f | sort - sales | head 10

Re: Top 10 Customers - exclude OTHER

ehaque — Sun, 19 Jul 2015 08:19:11 GMT

thanks guys!
fyi, looks like with 'limit' i dont need to sort anymore.

source="swerve_sales.csv" host="swerve" sourcetype="csv-sales" | timechart span=1w limit=10 useother=f sum(TOTAL) as sales by FIRSTNAME