topic How can I write a search that returns _time in 1-second intervals even when _time stamp doesn't match a value? in Splunk Search

How can I write a search that returns _time in 1-second intervals even when _time stamp doesn't match a value?

patilsh — Sat, 12 Aug 2017 00:13:06 GMT

Hello Guys,

I have a column _time

Ex Values (Suppose the search has 4 events here):
2017-08-11 12:06:51
2017-08-11 12:06:54
2017-08-11 12:06:56
2017-08-11 12:06:58

Now my intention is I want _time to increment by one second, that even though there is not row with 2017-08-11 12:06:52, I want to add a row with all other columns to be 0,

So my new data should look like
2017-08-11 12:06:51
2017-08-11 12:06:52
2017-08-11 12:06:53
2017-08-11 12:06:54
2017-08-11 12:06:55
2017-08-11 12:06:56
2017-08-11 12:06:57
2017-08-11 12:06:58
So all the appended time which was not there should have the other column entries of search as 0. The new search should have 8 events now.

Can someone please help me with this, as I am not able to understand how to do it.

Regards
Shailendra Patil

Re: How can I write a search that returns _time in 1-second intervals even when _time stamp doesn't match a value?

lfedak_splunk — Sat, 12 Aug 2017 00:34:47 GMT

Hey @patilsh, This might help? https://answers.splunk.com/answers/10147/how-to-show-events-per-second-in-timechart-regardless-of-span.html I'm just a community moderator, so I'll keep an eye on the post and try new tags if no experts see it this weekend.

Re: How can I write a search that returns _time in 1-second intervals even when _time stamp doesn't match a value?

cpetterborg — Sat, 12 Aug 2017 04:59:06 GMT

You don't explain exactly what your search is, but you can probably get most of what you need to use by reading the following answers entry:

https://answers.splunk.com/answers/103432/how-to-replace-all-null-values-between-two-dates-min-and-max-replace-null-0-values-in-timechart-gantchart-coveragechart-coveragedashboard.html

And here is the fillnull documentation:

https://docs.splunk.com/Documentation/SplunkCloud/6.6.0/SearchReference/Fillnull