topic Re: How to display graph column for zero value in Splunk Search

How to display graph column for zero value

tmaurst — Wed, 13 Feb 2019 23:42:25 GMT

I have a bar graph that charts two values. When one of the values is 0, the graph removes the column altogether. This makes it difficult to ascertain that two values are being compared. How can I keep a placeholder for a 0 value in the graph with the field name intact?

Thanks

Re: How to display graph column for zero value

woodcock — Thu, 14 Feb 2019 00:19:53 GMT

This is the Sentinel Search problem discussed (with solution) here:

https://conf.splunk.com/session/2015/conf2015-LookupTalk.pdf

Re: How to display graph column for zero value

tmaurst — Thu, 14 Feb 2019 17:08:51 GMT

Thanks. However I'm having a bit of trouble with the sentinel value implementation (found on pages 25-27).

index=myIndex AND sourcetype=mySource AND ("string1" OR "string2") | eval split=if(match(_raw, ".*string1*."), "Requests", "Timeouts") | inputlookup append=true Timeouts | chart count by split

The above query returns 'The lookup table Timeouts is invalid'. What am I missing?

Re: How to display graph column for zero value

woodcock — Thu, 14 Feb 2019 20:56:30 GMT

If you are creating an ad-hoc lookup, you must use Timeouts.csv. When you specify a lookup without .csv on the end, Splunk looks for a Lookup definition named, in this case, Timeouts, to see if it is a Lookup file or a KV Store. It does not find such and gives you this error. The other way around it is to create a lookup definition calledTimeouts that is file-based as Timeouts.csv.

Don't forget to click Accept to close the question.