Restricting a timechart to exclude the OTHER series when using a where clause

[jimhobday]

The Splunk Docs have this example under timechart

Example 3: Show the source series count of INFO events, but only where the total number of events is larger than 100. All other series values will be labeled as "other".

index=_internal | timechart span=1h sum(eval(if(log_level=="INFO",1,0))) by source WHERE sum > 100

In my own search, I'm trying to just show "where max in top5 " (or I could alternatively use "where max > 20000") but either way the results always contain the "OTHER" series for the rest of the results after the top 5 series. So you might get:

---Series 1

---Series 2

---Series 3

---OTHER

I'd like to exclude OTHER and I've tried limit=0 and limit=5 but I believe the limit option is ignored when a where clause is used. 

Does anyone have any ideas how I could work around this?

[anilchaithu · Accepted solution]

@jimhobday 

If you don't want other in your chart use the below flag in timechart command

useother=f

hope this helps

[jimhobday]

HI @anilchaithu - Thanks for that - totally solves my problem.

How did I miss that - it's right there in the documentation.