Reporting on "Other"

[a212830]

Hi,

I am doing a search to report on some eventtypes. The eventtypes report fine, but I also want to put anything that isn't categorized as an eventtype into "other" in the table. Is there a way to do this? s

[sowings · Accepted solution]

| where isnull(eventtype) ?

[a212830]

Awesome. Thanks. Just took the second reporting class and things are slowly clicking...

[sowings]

Sorry, I thought you wanted to search expressly for items which did not have an assigned eventtype. I suggest yannK's answer above.

[yannK]

source="/var/opt/trapx/log/traps-all.log" | eval eventtype=if(isnull(eventtype),"null",eventtype) | fields eventtype, host |chart count by eventtype, host |addcoltotals | addtotals fieldname=Totals

if the events have no eventtype, then the field will be created and populated with "null"

[a212830]

lost me on that - what is it doing?

My search is:
source="/var/opt/trapx/log/traps-all.log" | fields eventtype, host |chart count by eventtype, host |addcoltotals | addtotals fieldname=Totals

Which works fine, but ignores "non-eventtypes". I want to include totals for these in my chart.