Ignore null values

jackpal — Wed, 14 Oct 2020 13:09:28 GMT

I am using the nix agent to gather disk space. I only collect "df" information once per day. I want to be able to present a statistics table that only shows the rows with values. When I do the query below I get alot of empty rows. I'd like to only show the rows with data.

index=os sourcetype=df host=hostname filesystem=*mapper*lim*
| eval LIM_PROD_DISK=case(
filesystem LIKE "%limproda1%", "limproda1",
filesystem LIKE "%limproda2%", "limproda2",
filesystem LIKE "%limprodwide0%", "limprodwide0",
filesystem LIKE "%limprodwide1%", "limprodwide1",
filesystem LIKE "%limprodwide2%", "limprodwide2",
filesystem LIKE "%limtoolsvol%", "limptoolsvol"
)
| bin _time span=1d
| timechart max(storage_used_percent) by LIM_PROD_DISK

Re: Ignore null values

richgalloway — Wed, 14 Oct 2020 14:09:36 GMT

The timechart command has the cont option for that. Try

index=os sourcetype=df host=hostname filesystem=*mapper*lim* | eval LIM_PROD_DISK=case( filesystem LIKE "%limproda1%", "limproda1", filesystem LIKE "%limproda2%", "limproda2", filesystem LIKE "%limprodwide0%", "limprodwide0", filesystem LIKE "%limprodwide1%", "limprodwide1", filesystem LIKE "%limprodwide2%", "limprodwide2", filesystem LIKE "%limtoolsvol%", "limptoolsvol" ) | bin _time span=1d | timechart cont=f max(storage_used_percent) by LIM_PROD_DISK

topic Re: Ignore null values in Splunk Search

Ignore null values

Re: Ignore null values