Dashboards & Visualizations

Use the "OTHER" value for token-based search

mztopp
Explorer

I have a line graph that allows me to click on the line and it populates the Country and the date/time automatically, through the drilldown/XML code, into a new search. The issue is, I have top 10 countries and the rest get consolidated into the OTHER value. Ideally, I want the OTHER value to be able to search for all of the countries not in the top 10. Right now, it's setup that if I click OTHER, then the search would just say: Country="OTHER" (which is obviously not an actual country). Any help is greatly appreciated!

Labels (3)
0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...