Reporting

How can I show results from Other?

rtmcdonald
Explorer

When I create a chart it takes the bottom results and creates a category called Other. I want to show the results that are being lumped into other. How can I do that?

Thanks,

-Ryan

Tags (1)
0 Karma

ftk
Motivator

Since you indicated that christopherutz's answer did indeed answer your question, please accept his answer by clicking the green checkmark next to it so this question can be closed out. Thanks

0 Karma

christopherutz
Path Finder

Try

... | chart limit=0 ...

This is how I eliminate the aggregation of classes into an "other" category with timechart.

rtmcdonald
Explorer

That worked! Thanks....

0 Karma

christopherutz
Path Finder

Note. There was at one point (possibly still) a bug when using limit=0. If you run into an issue with an extra column check out this question.

http://answers.splunk.com/questions/4638/timechart-and-chart-display-buggy-column-count-when-using-l...

0 Karma

jhodges
Engager

add the useother paramter:

chart useother=0

0 Karma

rtmcdonald
Explorer

It looks like that just hides the column

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...