Remove unwanted subfolders in dashboard

[thaara]

Hi Splunkers,

We are getting unwanted sub folders when we search for a particular sub folder

I am creating a query which displays the file system for a particular folder. But I am getting all the folder names instead of a particular folder name alone.

Consider, in server xyz, we are having n number of file system (example, /, /var, /var/abc, /var/abc/cde, etc. ). When I am searching for /var alone by giving that in query, it displays /var and all the sub folders in it. But that is not as expected.

Query:
index=" " sourcetype= " " mn=/ OR /var | eval Usage=replace(Used,"%","") | timechart values(usage) as Used by mn

note: mn means the file system name

Expected output:
Chart should show only / and /var file systems.

Output we are getting now:
Chart should show only / and /var and /var/abc and /var/abc/cde

[niketn]

@thaara if you are using the following query I dont see how other subfolder will show up as you have not used * in the mn filter

 index=" " sourcetype= " " mn IN ("/","/var")