<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic How do you stop displaying a timechart line when value is 0? in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/How-do-you-stop-displaying-a-timechart-line-when-value-is-0/m-p/396074#M114995</link>
    <description>&lt;P&gt;I'm trying to display a timechart based on count by a type. &lt;/P&gt;

&lt;P&gt;But, for a certain type, the value will always be 0 for a certain time. &lt;/P&gt;

&lt;P&gt;is it possible to tell Splunk to simply stop displaying the line from a certain datetime ? or when the count is 0 ?  &lt;/P&gt;

&lt;P&gt;The screenshot below shows the different lines and the part I marked is supposed to be hidden.&lt;/P&gt;

&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper" image-alt="alt text"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/5840i11C2D5126B3D9070/image-size/large?v=v2&amp;amp;px=999" role="button" title="alt text" alt="alt text" /&gt;&lt;/span&gt;&lt;/P&gt;</description>
    <pubDate>Mon, 01 Oct 2018 14:06:10 GMT</pubDate>
    <dc:creator>dfofie</dc:creator>
    <dc:date>2018-10-01T14:06:10Z</dc:date>
    <item>
      <title>How do you stop displaying a timechart line when value is 0?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-do-you-stop-displaying-a-timechart-line-when-value-is-0/m-p/396074#M114995</link>
      <description>&lt;P&gt;I'm trying to display a timechart based on count by a type. &lt;/P&gt;

&lt;P&gt;But, for a certain type, the value will always be 0 for a certain time. &lt;/P&gt;

&lt;P&gt;is it possible to tell Splunk to simply stop displaying the line from a certain datetime ? or when the count is 0 ?  &lt;/P&gt;

&lt;P&gt;The screenshot below shows the different lines and the part I marked is supposed to be hidden.&lt;/P&gt;

&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper" image-alt="alt text"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/5840i11C2D5126B3D9070/image-size/large?v=v2&amp;amp;px=999" role="button" title="alt text" alt="alt text" /&gt;&lt;/span&gt;&lt;/P&gt;</description>
      <pubDate>Mon, 01 Oct 2018 14:06:10 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-do-you-stop-displaying-a-timechart-line-when-value-is-0/m-p/396074#M114995</guid>
      <dc:creator>dfofie</dc:creator>
      <dc:date>2018-10-01T14:06:10Z</dc:date>
    </item>
    <item>
      <title>Re: How do you stop displaying a timechart line when value is 0?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-do-you-stop-displaying-a-timechart-line-when-value-is-0/m-p/396075#M114996</link>
      <description>&lt;P&gt;How about adding , &lt;CODE&gt;where count&amp;gt;0&lt;/CODE&gt; in your query&lt;/P&gt;</description>
      <pubDate>Mon, 01 Oct 2018 15:39:58 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-do-you-stop-displaying-a-timechart-line-when-value-is-0/m-p/396075#M114996</guid>
      <dc:creator>Vijeta</dc:creator>
      <dc:date>2018-10-01T15:39:58Z</dc:date>
    </item>
    <item>
      <title>Re: How do you stop displaying a timechart line when value is 0?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-do-you-stop-displaying-a-timechart-line-when-value-is-0/m-p/396076#M114997</link>
      <description>&lt;P&gt;that doesn't work for me. When I enter where count&amp;gt;0 nothing appends. Not sure if this where clause is being taken in account.&lt;/P&gt;</description>
      <pubDate>Tue, 02 Oct 2018 06:40:13 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-do-you-stop-displaying-a-timechart-line-when-value-is-0/m-p/396076#M114997</guid>
      <dc:creator>dfofie</dc:creator>
      <dc:date>2018-10-02T06:40:13Z</dc:date>
    </item>
  </channel>
</rss>

