Filter ip_city in timechart

[gt2013]

Yello,
Being new to Splunk and still amazed at its capabilities, I have this query and trying to filter out ip_city name 'OTHER' that keeps showing up:

source="/users/a/access" | localop | lookup geo ip as remoteip | search ip_city != "other" | timechart count by ip_city

No cigar 😕

Would anyone be able to help?
Thanks in advance.

[lguinn2 · Accepted solution]

Aha! I think the problem is that the timechart command sees more than 10 (the default number) of ip_city values, so it only shows the first 10 in the chart, and summarizes the remainder into an entry called "OTHER". That's why you can't eliminate it with your search! (nice try, tho!)

Take a look at the timechart command, and perhaps use the options to try it this way instead:

source="/users/a/access"  | localop 
| lookup geo ip as remoteip 
| timechart limit=0 count by ip_city

I hope that will work for you! If not, perhaps there is a different problem. In that case, you might try this first, just to see what you get...

source="/users/a/access"  | localop 
| lookup geo ip as remoteip 
| stats count by ip_city

[gkanapathy]

or useother=false added to the timechart command if you only want the top 10.