Archive
Highlighted

I have a timechart trying create a dashboard a value by host and it's only showing 10 valid hosts the remaining hosts are put into this "Other" value.. How do i remove "Other" from the dashboard?

New Member

I have a timechart trying create a dashboard a value by host and it's only showing 10 valid hosts the remaining hosts are put into this "Other" value.. How do i remove "Other" from the dashboard?

Tags (1)
0 Karma
Highlighted

Re: I have a timechart trying create a dashboard a value by host and it's only showing 10 valid hosts the remaining hosts are put into this "Other" value.. How do i remove "Other" from the dashboard?

Builder

Try useother=f

Highlighted

Re: I have a timechart trying create a dashboard a value by host and it's only showing 10 valid hosts the remaining hosts are put into this "Other" value.. How do i remove "Other" from the dashboard?

Splunk Employee
Splunk Employee

Hi vijiaykumartcs,

To remove "other" values, please set the useother attribute to false in your query. Here's an example:

sourcetype=access_* action=purchase | timechart count by product usenull=f useother=f

You can also set usenull=f to filter out null values.
Hope it helps. Thanks!
Hunter Shen

0 Karma
Highlighted

Re: I have a timechart trying create a dashboard a value by host and it's only showing 10 valid hosts the remaining hosts are put into this "Other" value.. How do i remove "Other" from the dashboard?

Splunk Employee
Splunk Employee

Sorry for the typo - there shoud not be an asterisk at the end. Here is the corrected example query:

sourcetype=access_ action=purchase | timechart count by product usenull=f useother=f

0 Karma