Splunk Search

useother works incorrect

0range
Communicator

Hi all.
When I type "useother=f" in timechart some values are lost:
fro example, I've got 5-types events:
A - 10 events, B - 9 events, C - 9 events, D - 2 events, C - 3 events.

I type : "timechart bla bla"
I expect: "A - 10 events, B - 9 events, C - 9 events, OTHER - 3 events"
I see : "A - 10 events, B - 9 events, C - 9 events, OTHER - 3 events"

OK

I type : "timechart useother=f bla bla"
I expect : "A - 10 events, B - 9 events, C - 9 events, D - 2 events, C - 3 events"
I see: "A - 10 events, B - 9 events, C - 9 events"

They are just covered!!! Has anyone faced this problem?

Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

That's the intended behaviour. You're looking for limit=0 to avoid more than ten series of data to get collapsed into the other column. useother=f just hides that column, the default limit=10 is still in effect.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

That's the intended behaviour. You're looking for limit=0 to avoid more than ten series of data to get collapsed into the other column. useother=f just hides that column, the default limit=10 is still in effect.

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...