Omit "NULL" and "OTHER" from area chart

[srussellnpr]

How do I omit "NULL" and "OTHER" from the results of an area chart?

[Stephen_Sorkin · Accepted solution]

Assuming that you defined the chart using the search language directly, say with timechart, then you should add usenull=f useother=f to the end of the search like eventtype="download" | timechart count by useragent usenull=f useother=f.

If you built the report using the report builder or a link from a field, from the "2: Format report" window, click back to "1: Define report content" then click on "Define data using search language" if it's not already selected, and add usenull=f useother=f to the end of the search string.

[driptarup]

Hello Stephen,

I am using the flags "usenull=f useother=f" in my timechart search, but no logs are coming still, are there any limits being responsible for it?

[slgizmo]

Stephen,

I realize this is about seven years late but I wanted to thank you for this tidbit of information. Our reports just became more readable with not having to explain what "OTHER" is.

Gizmo

[imanpoeiri]

You've just received cookies!

[infinitiguy]

exactly what I was looking for!