search fields - OTHER

[Ant1D]

Hey,

By default when you run some Splunk searches, some of the results end up going under a field named OTHER.

I know that you can remove this data by adding | fields - OTHER to a search

How can I see the fields that make up the data found under OTHER instead of seeing this OTHER field?

[fox · Accepted solution]

try this:

index=..... search | timechart limit=0 count by source....

this will include all and bucket the 11th onwards into OTHER.

or if you still want to take advantage of the OTHER bucket but increase visibility:

index=..... search | timechart limit=40 count by source....

by default limit is set to 10 (however this can also be adjusted in a system conf file.)

[willthames]

Do you mean you want to break OTHER into the fields that you want to extract?

It sounds like you need to improve upon the matching done by Splunk by creating your own extractions - there is more than one way to do this, see http://www.splunk.com/base/Documentation/latest/Knowledge/Addfieldsatsearchtime

I use transforms.conf to create new extractions but you might prefer one of the other ways.

If I've misunderstood what you're trying to do, apologies.

[Ant1D]

Hi willthames, Yes your understanding is correct. My instance currently uses many field extractions but the OTHER field still turns up on occasion to make its presence felt and you cannot drilldown on the OTHER field. So, I was hoping that I could do something to find out what data is really going under this OTHER field.