Splunk Search

[Need Help] how to expand 'OTHER' column created by stats command

cheriemilk
Path Finder

Hi team,

when I use stats command to group and aggregration. For example:  

<base query here>
| bin span=1d _time
| stats count(eval(autosave=1)) as autosave
count(eval(autosave=0 OR autosave=1)) as total by _time, DC .

There's a column named 'OTHER' created.  I want all the columns displayed, instead of group into 'OTHER' column if the number of columns are many. 

I know that for timechart command there's a parameter useother=false can do this. but I can't find asuch a paramter for stats command , can you help?

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The stats command does NOT produce a field called "OTHER".  The only fields returned by stats are those named ("autosave", "total", "_time", and "DC" in the example query) in the command.  

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

cheriemilk
Path Finder

Hi @richgalloway 

Sorry that i was just awared that the 'OTHER' column is created by chart command, instead of stats.

| stats count(eval(autosave=1)) as autosave count(eval(autosave=0 OR autosave=1)) as total by _time , DC
| eval percent=round(autosave * 100 / total,2)
| chart values(total) as total values(autosave) as autosave values(percent) as percent by _time , DC

How to expand 'OTHER' column?

Thanks,

Cherie

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The chart command has a useother option.

| chart useother=f values(total) as total values(autosave) as autosave values(percent) as percent by _time , DC
---
If this reply helps you, an upvote would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The stats command does NOT produce a field called "OTHER".  The only fields returned by stats are those named ("autosave", "total", "_time", and "DC" in the example query) in the command.  

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

cheriemilk
Path Finder

Hi @richgalloway 

 

I found this useother=false can applied to chart command as well, just like timechart command.

 

Thanks.

0 Karma