Splunk Search

[Need Help] how to expand 'OTHER' column created by stats command

cheriemilk
Path Finder

Hi team,

when I use stats command to group and aggregration. For example:  

<base query here>
| bin span=1d _time
| stats count(eval(autosave=1)) as autosave
count(eval(autosave=0 OR autosave=1)) as total by _time, DC .

There's a column named 'OTHER' created.  I want all the columns displayed, instead of group into 'OTHER' column if the number of columns are many. 

I know that for timechart command there's a parameter useother=false can do this. but I can't find asuch a paramter for stats command , can you help?

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The stats command does NOT produce a field called "OTHER".  The only fields returned by stats are those named ("autosave", "total", "_time", and "DC" in the example query) in the command.  

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

cheriemilk
Path Finder

Hi @richgalloway 

Sorry that i was just awared that the 'OTHER' column is created by chart command, instead of stats.

| stats count(eval(autosave=1)) as autosave count(eval(autosave=0 OR autosave=1)) as total by _time , DC
| eval percent=round(autosave * 100 / total,2)
| chart values(total) as total values(autosave) as autosave values(percent) as percent by _time , DC

How to expand 'OTHER' column?

Thanks,

Cherie

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The chart command has a useother option.

| chart useother=f values(total) as total values(autosave) as autosave values(percent) as percent by _time , DC
---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The stats command does NOT produce a field called "OTHER".  The only fields returned by stats are those named ("autosave", "total", "_time", and "DC" in the example query) in the command.  

---
If this reply helps you, Karma would be appreciated.
0 Karma

cheriemilk
Path Finder

Hi @richgalloway 

 

I found this useother=false can applied to chart command as well, just like timechart command.

 

Thanks.

0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...