Splunk Search

How to show only certain values in a chart

acontarciego
Explorer

I have a search that get code values:
How can I show only the count of 4 values in a chart and have the rest reported as "OTHER".

Tags (1)
0 Karma

Ayn
Legend
... | top 4 yourfield useother=t
0 Karma

acontarciego
Explorer

One more twist. How do I show this in a time chart?

0 Karma

Ayn
Legend

Ah, that's a bit trickier. This is the solution I can think of right now - possibly there's a 'neater' solution, but if there is one I'll have to sleep on it. :slightly_smiling_face:

... | stats count(eval(yourfield=="value1")) as value1, count(eval(yourfield=="value2")) as value2, count(eval(yourfield=="value3")) as value3, count(eval(yourfield=="value4")) as value4, count(eval(match(yourfield,"value1|value2|value3|value4"))) as OTHER | transpose
0 Karma

acontarciego
Explorer

Thanks, Ayn.
That works if I want the top 4 values. I forgot to mention that the 4 values I want will not necessarily by the top 4 by count.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...