Dashboards & Visualizations

"useother=f" in a pie chart

tven7
Path Finder

how do you get rid of this in pie charts pleas? I see OTHER take up a big piece of the pie right now in my search.

index=xyz exception | stats count(exception_message) by exception_message

Labels (1)
Tags (2)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

You have to use chart instead of stats.

View solution in original post

wdelaronde
New Member

In your chart the syntax would look like this:
| chart useother=f usenull=f

0 Karma

lycollicott
Motivator

A version 7.0 answer for anyone searching in 2017+

In addition to useother=false set a Minimum Size of 0 in Format:

alt text

GavinDSPLUNK
Engager

Thanks, you just helped a noob from losing his mind!

Tags (2)
0 Karma

ravikanthbadugu
New Member

I tried making minimum size to 0 and that worked.

Thank you.

0 Karma

rogerdpack
Path Finder

You may be able to add "NOT index=OTHER" to the search criteria.

having useother=f works for me here, though.

I also was seeing NULL entries and added "AND index=*" to get rid of them.

0 Karma

lguinn2
Legend

NOT index=OTHER

will not work unless there is actually an index named "OTHER"

0 Karma

tven7
Path Finder

thank you.

gkanapathy
Splunk Employee
Splunk Employee

You have to use chart instead of stats.

Dark_Ichigo
Builder

This doesnt work for me, no matter what I do it will always display the Other field only on the Pie Chart and not as a Field in the results.

Im using Splunk V4.3.2, is there a fix for this?

0 Karma

darlas
Communicator

I have this same issue with Pie chart. I'm using Splunk 6.2. usenull=f with Chart command still shows "other" slice. And the Not index=OTHER gives syntax errors. Any ideas?

0 Karma

lguinn2
Legend

So the command is

index=xyz exception | chart count(exception_message) by exception_message useother=f

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...