Splunk Search

Omit "NULL" and "OTHER" from area chart

srussellnpr
Explorer

How do I omit "NULL" and "OTHER" from the results of an area chart?

1 Solution

Stephen_Sorkin
Splunk Employee
Splunk Employee

Assuming that you defined the chart using the search language directly, say with timechart, then you should add usenull=f useother=f to the end of the search like eventtype="download" | timechart count by useragent usenull=f useother=f.

If you built the report using the report builder or a link from a field, from the "2: Format report" window, click back to "1: Define report content" then click on "Define data using search language" if it's not already selected, and add usenull=f useother=f to the end of the search string.

View solution in original post

Stephen_Sorkin
Splunk Employee
Splunk Employee

Assuming that you defined the chart using the search language directly, say with timechart, then you should add usenull=f useother=f to the end of the search like eventtype="download" | timechart count by useragent usenull=f useother=f.

If you built the report using the report builder or a link from a field, from the "2: Format report" window, click back to "1: Define report content" then click on "Define data using search language" if it's not already selected, and add usenull=f useother=f to the end of the search string.

driptarup
Engager

Hello Stephen,

I am using the flags "usenull=f useother=f" in my timechart search, but no logs are coming still, are there any limits being responsible for it?

0 Karma

slgizmo
New Member

Stephen,

I realize this is about seven years late but I wanted to thank you for this tidbit of information. Our reports just became more readable with not having to explain what "OTHER" is.

Gizmo

0 Karma

imanpoeiri
Communicator

You've just received cookies!

0 Karma

infinitiguy
Path Finder

exactly what I was looking for!

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...