[Need Help] how to expand 'OTHER' column created by stats command

[cheriemilk]

Hi team,

when I use stats command to group and aggregration. For example:  

<base query here>
| bin span=1d _time
| stats count(eval(autosave=1)) as autosave
count(eval(autosave=0 OR autosave=1)) as total by _time, DC .

There's a column named 'OTHER' created.  I want all the columns displayed, instead of group into 'OTHER' column if the number of columns are many. 

I know that for timechart command there's a parameter useother=false can do this. but I can't find asuch a paramter for stats command , can you help?

[cheriemilk]

Hi @richgalloway 

Sorry that i was just awared that the 'OTHER' column is created by chart command, instead of stats.

| stats count(eval(autosave=1)) as autosave count(eval(autosave=0 OR autosave=1)) as total by _time , DC
| eval percent=round(autosave * 100 / total,2)
| chart values(total) as total values(autosave) as autosave values(percent) as percent by _time , DC

How to expand 'OTHER' column?

Thanks,

Cherie

[richgalloway]

The chart command has a useother option.

| chart useother=f values(total) as total values(autosave) as autosave values(percent) as percent by _time , DC

[richgalloway · Accepted solution]

The stats command does NOT produce a field called "OTHER".  The only fields returned by stats are those named ("autosave", "total", "_time", and "DC" in the example query) in the command.  

[cheriemilk]

Hi @richgalloway 

I found this useother=false can applied to chart command as well, just like timechart command.

Thanks.