topic Re: Limiting timechart span to only include values > 0 in Splunk Search

Limiting timechart span to only include values > 0

ericrobinson — Thu, 03 Mar 2011 00:54:01 GMT

I have a search that is returning the value of a field called num_oracle_batch. I am using the following to get a per_minute count of the number of batches:

timechart span=1m per_minute(num_oracle_batch)

My question is, how can I limit the timechart to only show where the value of num_oracle_batch is an actual number. As it stands, if I choose today from the timepicker, my Y axis is the entire day even though I only had matching search results in only a few minutes in the 9 oclock hour.

So in short, can I dynamically set my timerange based on event results?

Re: Limiting timechart span to only include values > 0

David — Thu, 03 Mar 2011 01:33:10 GMT

You can add cont=f to the timechart options, making the chart not continuous. With that, your timechart becomes:

timechart span=1m per_minute(num_oracle_batch) cont=f

(From: http://www.splunk.com/base/Documentation/latest/SearchReference/Timechart#Arguments)

Let me know if that doesn't work.

Re: Limiting timechart span to only include values > 0

ericrobinson — Fri, 04 Mar 2011 01:29:50 GMT

Thats exactly what I was looking for. I have been struggling with sub-searches and where clauses to get what I was looking for.

THANKS!

Re: Limiting timechart span to only include values > 0

David — Fri, 04 Mar 2011 04:37:38 GMT

My pleasure. I'd had the same question before, but had never looked up the answer. It's good to know!