Splunk Search

How to remove this signal "-" and "OTHER" in results of a timechart?

lucasdc
New Member

Hi Splunkers, I have this search bellow:

index=br_activedirectory_microsoft EventCode=4624 Account_Domain=AGBANESPA Account_Name=A* earliest=-169h latest=now()
| fields Account_Domain, Account_Name, Source_Network_Address
| dedup Account_Domain, Account_Name, Source_Network_Address
| lookup dnslookup clientip as Source_Network_Address OUTPUT clienthost
| eval user = substr(mvindex(Account_Name,1),2,4)
| eval hostname = substr(clienthost,3,4)
| where user !=hostname
| lookup new_hostname_lookup hostname as hostname OUTPUT ENDEREÇO, UF, REG, CEP , REDE
| lookup new_user_lookup user as user OUTPUT ENDEREÇO_user, UF_user, REG_user, CEP_user ,REDE_user
| where REG !=REG_user AND REDE !=REDE_user
| rename "Account_Name" as "Historico de logins com sucesso"
| timechart count by "Historico de logins com sucesso"

And the output is this:

![alt text

How do I remove from my search this "-" and "OTHER"??

Thanks!

0 Karma
1 Solution

Vijeta
Influencer

@lucasdc At the end of your search you can use fields - "OTHER" , "-".

<your query> | fields - OTHER, "-"

View solution in original post

0 Karma

Vijeta
Influencer

@lucasdc At the end of your search you can use fields - "OTHER" , "-".

<your query> | fields - OTHER, "-"
0 Karma

DavidHourani
Super Champion

Hi @lucasdc,

You can use the option useother=f for timechart to remove the OTHER column. I advise you as well to set the number of columns you want your timechart to show, it defaults to 10 with an OTHER column grouping the rest, you can change it by setting the limit parameter for timechart. You timechart would then look like this :

| timechart count by "Historico de logins com sucesso" useother=f limit=15

And to remove any other field you can use field -so it would be field - "-" to remove the "-" column. Your whole query becomes :

   ...| timechart count by "Historico de logins com sucesso" useother=f limit=15 | field - "-"

Let me know if that helps.

Cheers,
David

lucasdc
New Member

Thanks David! it's worked! you'r the man!

0 Karma

DavidHourani
Super Champion

Awesome ! please accept the answer and up-vote it 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...