Splunk Search

how to remove other values

mkhedr
Explorer

how to remove other values from this search syntax

index=main sourcetype=access_combined_wcookie productId
| chart count by clientip | iplocation clientip
| geostats count by clientip globallimit=5

Tags (1)
0 Karma

MuS
SplunkTrust
SplunkTrust

Hi mkhedr,

the docs of geostats https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Geostats#Optional_arguments say this:

globallimit 
Syntax: globallimit=<int> 
Description: Controls the number of named categories to add to each pie chart. There is one additional category called "OTHER" under which all other split-by values are grouped. Setting globallimit=0 removes all limits and all categories are rendered. Currently the grouping into "OTHER" only works intuitively for count and additive statistics. Default: 10

Run the same search with | geostats count by clientip globallimit=0 and the other group is no longer available.

Hope this helps ...

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...