topic Remove rows without result from timechart count query in Splunk Search

Remove rows without result from timechart count query

jam00 — Sun, 19 May 2019 13:17:03 GMT

Hello,
I have the following query:
sourcetype=access_* action="purchase" | timechart count by productName usenull=f useother=f

And I get a timechart with zeros: https://imgur.com/a/XWdbIZH

Do you know a way to remove that rows with zeros? Is it possible to reference timechart "count" as a variable to use it with "where" command: | where $count$ > 0 , or something like that?

Thanks in advance

Re: Remove rows without result from timechart count query

niketn — Sun, 19 May 2019 15:00:35 GMT

@jam00 you should try timechart option cont=f, the rows with all zeros will be removed.

sourcetype=access_* action="purchase" 
| timechart count by productName cont=f usenull=f useother=f

Refer to documentation: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Timechart#Optional_arguments

Re: Remove rows without result from timechart count query

jam00 — Sun, 19 May 2019 19:13:10 GMT

@niketnilay I hadn't considered that argument. Thank you so much.