The Splunk Docs have this example under timechart
Example 3: Show the source series count of INFO events, but only where the total number of events is larger than 100. All other series values will be labeled as "other".
index=_internal | timechart span=1h sum(eval(if(log_level=="INFO",1,0))) by source WHERE sum > 100
In my own search, I'm trying to just show "where max in top5 " (or I could alternatively use "where max > 20000") but either way the results always contain the "OTHER" series for the rest of the results after the top 5 series. So you might get:
---Series 1
---Series 2
---Series 3
---OTHER
I'd like to exclude OTHER and I've tried limit=0 and limit=5 but I believe the limit option is ignored when a where clause is used.
Does anyone have any ideas how I could work around this?
If you don't want other in your chart use the below flag in timechart command
useother=f
hope this helps
If you don't want other in your chart use the below flag in timechart command
useother=f
hope this helps
HI @anilchaithu - Thanks for that - totally solves my problem.
How did I miss that - it's right there in the documentation.