Dashboards & Visualizations

drilldown OTHER in a chart

wsw70
Communicator

Hello,

I have a bar chart created from the following search:

eventtype="EVENT_OSCE_Virus" | dedup Virus, destination | timechart count by Virus

The idea was to get a stacked bar chart of viral activity for the past week. It works fine, the chart is correct. I can also drill down by clicking on a virus name on the legend, or the relevant stack layer on the chart.

All this except for the automatically created OTHER category which groups the remaining events. When clicking on it I get the search

eventtype="EVENT_OSCE_Virus" | dedup Virus, destination | search Virus="OTHER"

which is obviously wrong. It should rather be something like

eventtype="EVENT_OSCE_Virus" | dedup Virus, destination | search NOT (Virus="first virus in 
the legend" OR Virus="second virus in the legend" ...)

Is there a way to modify the default behavior for this kind of drilldown (ie. for a drilldown which uses the OTHER category)?

Thank you.

Tags (1)
1 Solution

Ant1D
Motivator

Hi,

You cannot drilldown on the OTHER field and my understanding is that you cannot modify the behaviour of this field. If you want to see what exactly is going into your OTHER category for drilldown purposes, you can change your search to the following:

eventtype="EVENT_OSCE_Virus" | dedup Virus, destination | timechart limit=50 count by Virus

The limit=50 inclusion will show the top 50 Virus values. After those top 50 values are shown, it will place the remaining values (if there are more than 50 results) into the OTHER field. You can increase or decrease the limit value to your liking.

View solution in original post

0 Karma

Ant1D
Motivator

Hi,

You cannot drilldown on the OTHER field and my understanding is that you cannot modify the behaviour of this field. If you want to see what exactly is going into your OTHER category for drilldown purposes, you can change your search to the following:

eventtype="EVENT_OSCE_Virus" | dedup Virus, destination | timechart limit=50 count by Virus

The limit=50 inclusion will show the top 50 Virus values. After those top 50 values are shown, it will place the remaining values (if there are more than 50 results) into the OTHER field. You can increase or decrease the limit value to your liking.

0 Karma

wsw70
Communicator

Thanks - this is what I was afraid of. I was hoping somehow that OTHER could be tweaked to display "everything except the values shown"

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...