Splunk Search

Restricting a timechart to exclude the OTHER series when using a where clause

jimhobday
Engager

The Splunk Docs have this example under timechart

Example 3: Show the source series count of INFO events, but only where the total number of events is larger than 100. All other series values will be labeled as "other".

index=_internal | timechart span=1h sum(eval(if(log_level=="INFO",1,0))) by source WHERE sum > 100

In my own search, I'm trying to just show "where max in top5 " (or I could alternatively use "where max > 20000") but either way the results always contain the "OTHER" series for the rest of the results after the top 5 series. So you might get:

---Series 1

---Series 2

---Series 3

---OTHER

I'd like to exclude OTHER and I've tried limit=0 and limit=5 but I believe the limit option is ignored when a where clause is used. 

Does anyone have any ideas how I could work around this?

Labels (1)
0 Karma
1 Solution

anilchaithu
Builder

@jimhobday 

If you don't want other in your chart use the below flag in timechart command

useother=f

 

hope this helps

 

View solution in original post

0 Karma

anilchaithu
Builder

@jimhobday 

If you don't want other in your chart use the below flag in timechart command

useother=f

 

hope this helps

 

0 Karma

jimhobday
Engager

HI @anilchaithu - Thanks for that - totally solves my problem.

How did I miss that - it's right there in the documentation.

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...