topic Re: chart only display when event exist at day / day hour in Splunk Search

chart only display when event exist at day / day hour

buzek — Wed, 13 Nov 2019 17:49:52 GMT

how to display in chart only the days (or day & hour) when a „event“ (in my case speedtest results) is/are available.

i do not need „count“, „avg“ …
in the community i found:
| timechart fixedrange=false count

but, cause i dont need/use „count by XY“ this is useless for me.

and, it can be to have more than just one (1) result per day.

_time           field_speedUp   field_speed_Down
2019/11/13 14:35:09     800     400
2019/11/13 14:37:28       300       200

thanks for helping 😉

Re: chart only display when event exist at day / day hour

to4kawa — Sun, 17 Nov 2019 12:38:51 GMT

| makeresults
| eval raw="time            field_speedUp    field_speed_Down
2019/11/13 14:35:09      800        400
2019/11/13 14:37:28       300        200
2019/11/13 14:39:28       400        200"
| eval _raw=replace(raw,"  +",",")
| multikv forceheader=1
| eval _time=strptime(time,"%Y/%m/%d %H:%M:%S")
`comment("this is sample data")`
| table _time field_speedUp field_speed_Down

Hi, check Visualization and Line Chart
To separate _time, use bin command.

Re: chart only display when event exist at day / day hour

woodcock — Mon, 18 Nov 2019 04:19:20 GMT

Like this:

... | timechart fixedrange=false first(speedup) AS speedup first(speeddown) AS speeddown

Re: chart only display when event exist at day / day hour

buzek — Mon, 18 Nov 2019 19:52:22 GMT

Thank you. That's exactly what I was looking for.
- michael

Re: chart only display when event exist at day / day hour

buzek — Mon, 18 Nov 2019 19:52:40 GMT

thank you woodcock