Splunk Search

Omit "NULL" and "OTHER" from area chart

srussellnpr
Explorer

How do I omit "NULL" and "OTHER" from the results of an area chart?

1 Solution

Stephen_Sorkin
Splunk Employee
Splunk Employee

Assuming that you defined the chart using the search language directly, say with timechart, then you should add usenull=f useother=f to the end of the search like eventtype="download" | timechart count by useragent usenull=f useother=f.

If you built the report using the report builder or a link from a field, from the "2: Format report" window, click back to "1: Define report content" then click on "Define data using search language" if it's not already selected, and add usenull=f useother=f to the end of the search string.

View solution in original post

Stephen_Sorkin
Splunk Employee
Splunk Employee

Assuming that you defined the chart using the search language directly, say with timechart, then you should add usenull=f useother=f to the end of the search like eventtype="download" | timechart count by useragent usenull=f useother=f.

If you built the report using the report builder or a link from a field, from the "2: Format report" window, click back to "1: Define report content" then click on "Define data using search language" if it's not already selected, and add usenull=f useother=f to the end of the search string.

driptarup
Engager

Hello Stephen,

I am using the flags "usenull=f useother=f" in my timechart search, but no logs are coming still, are there any limits being responsible for it?

slgizmo
Explorer

Stephen,

I realize this is about seven years late but I wanted to thank you for this tidbit of information. Our reports just became more readable with not having to explain what "OTHER" is.

Gizmo

imanpoeiri
Communicator

You've just received cookies!

0 Karma

infinitiguy
Path Finder

exactly what I was looking for!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...