I have a timechart trying create a dashboard a value by host and it's only showing 10 valid hosts the remaining hosts are put into this "Other" value.. How do i remove "Other" from the dashboard?
To remove "other" values, please set the useother attribute to false in your query. Here's an example:
sourcetype=access_* action=purchase | timechart count by product usenull=f useother=f
You can also set usenull=f to filter out null values.
Hope it helps. Thanks!
Sorry for the typo - there shoud not be an asterisk at the end. Here is the corrected example query:
sourcetype=access_ action=purchase | timechart count by product usenull=f useother=f