"useother=f" in a pie chart

[tven7]

how do you get rid of this in pie charts pleas? I see OTHER take up a big piece of the pie right now in my search.

index=xyz exception | stats count(exception_message) by exception_message

[wdelaronde]

In your chart the syntax would look like this:
| chart useother=f usenull=f

[lycollicott]

A version 7.0 answer for anyone searching in 2017+

In addition to useother=false set a Minimum Size of 0 in Format:

[GavinDSPLUNK]

Thanks, you just helped a noob from losing his mind!

[ravikanthbadugu]

I tried making minimum size to 0 and that worked.

Thank you.

[rogerdpack]

You may be able to add "NOT index=OTHER" to the search criteria.

having useother=f works for me here, though.

I also was seeing NULL entries and added "AND index=*" to get rid of them.

[lguinn2]

NOT index=OTHER

will not work unless there is actually an index named "OTHER"

[tven7]

thank you.

[gkanapathy · Accepted solution]

You have to use chart instead of stats.

[Dark_Ichigo]

This doesnt work for me, no matter what I do it will always display the Other field only on the Pie Chart and not as a Field in the results.

Im using Splunk V4.3.2, is there a fix for this?

[darlas]

I have this same issue with Pie chart. I'm using Splunk 6.2. usenull=f with Chart command still shows "other" slice. And the Not index=OTHER gives syntax errors. Any ideas?

[lguinn2]

So the command is

index=xyz exception | chart count(exception_message) by exception_message useother=f