Splunk Search

Omit a tag from a timechart

dperry
Communicator

I have 5 tags:

tag1
tag2
tag3
tag4
tag5

index=my_index sourcetype=inetpub host=myhost "video=0"| timechart count by tag

I want to omit one of the tags on my timechart (similar to "other") and only show tags 1-4...Is this possible?

Tags (2)
0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

index=my_index sourcetype=inetpub host=myhost "video=0" tag!=tag1 | timechart count by tag

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

index=my_index sourcetype=inetpub host=myhost "video=0" tag!=tag1 | timechart count by tag
0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...