I have a timechart trying create a dashboard a value by host and it's only showing 10 valid hosts the remaining hosts are put into this "Other" value.. How do i remove "Other" from the dashboard?

[vijaykumartcs]

I have a timechart trying create a dashboard a value by host and it's only showing 10 valid hosts the remaining hosts are put into this "Other" value.. How do i remove "Other" from the dashboard?

[hunters_splunk]

Hi vijiaykumartcs,

To remove "other" values, please set the useother attribute to false in your query. Here's an example:

sourcetype=access_* action=purchase | timechart count by product usenull=f useother=f

You can also set usenull=f to filter out null values.
Hope it helps. Thanks!
Hunter Shen

[hunters_splunk]

Sorry for the typo - there shoud not be an asterisk at the end. Here is the corrected example query:

sourcetype=access_ action=purchase | timechart count by product usenull=f useother=f

[DEAD_BEEF]

Try useother=f