topic How do I remove gaps in charts? in Splunk Search

How do I remove gaps in charts?

ADRIANODL — Thu, 27 Sep 2018 12:04:48 GMT

Hi splunkers,

I was able to plot a graph that, whilst it shows all the info I need, it also contains massive gaps that make it less appealing.
Is it possible to eliminate those gaps? I'm not concerned about keeping the timeframe consistent.

MY search is as follows:

> index=crypto CurrencyB="CND" OR
> CurrencyS="CND"  | timechart
> sum(eval(if(CurrencyB="CND",Buy,Sell
> *-1))) as Total,  sum(eval(if(CurrencyB="CND",round(Sell/Buy,8),null)))
> as UnitPrice  span=d cont=FALSE |
> streamstats sum(Total) as Gtotal

Cheers

Re: How do I remove gaps in charts?

VatsalJagani — Thu, 27 Sep 2018 14:12:09 GMT

Hi @ADRIANODL,
Ideally your query should work fine and as expected as you have mentioned cont=false with timechart, but if you are using old version of Splunk then please check Splunk doc of timechart (http://docs.splunk.com/Documentation/Splunk/5.0.6/SearchReference/Timechart) with Splunk version are you using. If not work try another approach below with stats function, if you are sure you want your data month wise (as show in the attached screenshot of question) then following query may help.

index=crypto CurrencyB="CND" OR CurrencyS="CND" 
| eval month=date_month." ".date_year
| stats sum(eval(if(CurrencyB="CND",Buy,Sell*-1))) as Total, sum(eval(if(CurrencyB="CND",round(Sell/Buy,8),null))) as UnitPrice by month
| streamstats sum(Total) as Gtotal

Try above query!!

Re: How do I remove gaps in charts?

Vijeta — Thu, 27 Sep 2018 14:43:10 GMT

Did you try using cont=TRUE?

Re: How do I remove gaps in charts?

ADRIANODL — Thu, 27 Sep 2018 21:00:11 GMT

Hi Vatsal,
Actually, the data shown refers to days, not months. So at specific days of the year, certain events happened; I just want to show those, without the gaps. I'll try your query and let you know.

Re: How do I remove gaps in charts?

ADRIANODL — Fri, 28 Sep 2018 00:20:18 GMT

Hi Vatsal,
No luck, it groups things by month. 😞

Re: How do I remove gaps in charts?

ADRIANODL — Fri, 28 Sep 2018 00:20:47 GMT

I did, it fills the gaps with bars, which is not what I want. Thanks though Vijeta!

Re: How do I remove gaps in charts?

ADRIANODL — Fri, 28 Sep 2018 01:34:16 GMT

this is what I'm looking for... sorry for the crappy chart but it gives you an idea 🙂

Re: How do I remove gaps in charts?

VatsalJagani — Fri, 28 Sep 2018 03:50:00 GMT

Hi ADRIANODL,
I think in my case it is working just by writing cont=false, nothing else is required. Can you tell me which Splunk version are you working on?