Dashboards & Visualizations

remove element from a chart

Path Finder

hi, i'm trying to get a simple pie chart of all my eventtypes for my dash board; the problem is that we currently have all log entries come in with the eventtype 'unix-all-logs'; which means not only am i double counting, but also has a rather large (50%) slice for the unix-add-logs.

is there a way i can remove just that entry from the output? or do i have to persuade who ever to not apply that eventtype to everything?

sourcetype=cisco_syslog | top limit=0 eventtype 
Tags (2)
0 Karma


Just remove the eventtype 'unix-all-logs' from your base search.

sourcetype=cisco_syslog AND NOT eventtype="unix-all-logs" | top limit=0 eventtype
0 Karma

New Member

He indicated that every log entry comes in with that eventtype, so won't this exclude all entries?

0 Karma
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...