Splunk Search
Highlighted

Drilldown on OTHER field

Motivator

Hey,

There is a field named OTHER which tends to appear at times in my search results. However, if I drilldown on this field (e.g. Click on a chart cell representing this OTHER field) the flashtimeline view will display no results.

Is there a way to get results to be displayed for the OTHER field? (This would enable me to see what data is going under this field and why).

I know that I can stop this field from appear via | fields - OTHER but sometimes this field has a fairly significant count in search results so I don't want to disregard this field.

Thanks in advance for your help.

Highlighted

Re: Drilldown on OTHER field

Splunk Employee
Splunk Employee

This may be something you can do with sideview_utils, and specifically the ValueSetter module. That will require you to delve into Advanced XML (and beyond that, to the sideview modules), so it might be more hassle than it's worth, but it could be something to consider.

You might also be able to get away with by doing your search as a subsearch, with a NOT. Not sure how it'd play out, but maybe it could get you what you want (albeit with another link / table / etc.)

0 Karma
Highlighted

Re: Drilldown on OTHER field

Motivator

Thanks for the info David

0 Karma
Highlighted

Re: Drilldown on OTHER field

SplunkTrust
SplunkTrust

Well the most basic way is to throw a limit=50 into your timechart or chart. That makes it display up to 50 (or whatever) before it starts lumping everybody into OTHER.

eg

 <your search> | timechart avg(session_length) by user limit=50

or

 <your search> | chart dc(users) by clientip limit=50

It doesnt make the 'OTHER' go away entirely but when the top 10 items leaves a significant slice of "OTHER" in the chart, often the top 50 will leave a much smaller slice and it becomes a much lower usability problem. The legend kind of goes off into space and you cant use it, but the user can mouseover the individual blocks or lines on the chart and see them still...

To david's point, sideview_utils makes a ton of stuff way easier, but this is more a search-language thing and it's best solved with search-language solutions.

View solution in original post

Highlighted

Re: Drilldown on OTHER field

Motivator

Thanks for the info Nick

0 Karma
Highlighted

Re: Drilldown on OTHER field

SplunkTrust
SplunkTrust

NP. There are things you can do with a little bit of JS in application.js, and I might roll something into application.js, but it's a bit nutty. Think "field!=value1 field!=value2 field!=value3...." kind of a pain in the ass but it wouldnt be too hard for me to roll it generically into a patch to the tables and charts and apply the patch from sideview_utils...

0 Karma