https://community.splunk.com/t5/Splunk-Search/Timecharting-null-values/m-p/551295#M156440 <P>The <FONT face="courier new,courier">timechart</FONT> command requires the _time field, which <FONT face="courier new,courier">fieldsummary</FONT> does not supply.</P> Wed, 12 May 2021 00:30:35 GMT richgalloway 2021-05-12T00:30:35Z https://community.splunk.com/t5/Splunk-Search/Timecharting-null-values/m-p/551277#M156434 <P>Is there a way, that anyone is aware of, to timechart off of a field sumarry. I can break down the fieldsummary by timecharting first, I just end up with repeated field names with what looks like hashes appended to them, which is weird. I am trying to detrmine all the NULL fields and present them in a timecharted graph by day. Currently, without the timechart portion, this is what I have.&nbsp;</P><P>&nbsp;</P><P>...| fieldsummary<BR />| search values=*Unknown*<BR />| rex field=values \"Unknown\"\\S\"count\":(?&lt;null_count&gt;\\d+)},<BR />|eval percent_null=(null_count/count)*100<BR />|eval Percent1=100-percent_null<BR />|fields field Percent1 null_count</P> Tue, 11 May 2021 19:06:19 GMT https://community.splunk.com/t5/Splunk-Search/Timecharting-null-values/m-p/551277#M156434 bspargur 2021-05-11T19:06:19Z https://community.splunk.com/t5/Splunk-Search/Timecharting-null-values/m-p/551295#M156440 <P>The <FONT face="courier new,courier">timechart</FONT> command requires the _time field, which <FONT face="courier new,courier">fieldsummary</FONT> does not supply.</P> Wed, 12 May 2021 00:30:35 GMT https://community.splunk.com/t5/Splunk-Search/Timecharting-null-values/m-p/551295#M156440 richgalloway 2021-05-12T00:30:35Z https://community.splunk.com/t5/Splunk-Search/Timecharting-null-values/m-p/551402#M156478 <P>The _time can be used prior to the field summary command being run, I just get crazy outputs. If there is a better way to do what I am trying to do, that would work too. I am just not quite sure how to get it to work right.</P> Wed, 12 May 2021 21:01:20 GMT https://community.splunk.com/t5/Splunk-Search/Timecharting-null-values/m-p/551402#M156478 bspargur 2021-05-12T21:01:20Z https://community.splunk.com/t5/Splunk-Search/Timecharting-null-values/m-p/551446#M156491 <P>Is there another way to do what?&nbsp; Please describe your desired output.&nbsp; What do you mean by "crazy outputs"?&nbsp; What problem are you trying to solve?</P> Thu, 13 May 2021 12:22:55 GMT https://community.splunk.com/t5/Splunk-Search/Timecharting-null-values/m-p/551446#M156491 richgalloway 2021-05-13T12:22:55Z https://community.splunk.com/t5/Splunk-Search/Timecharting-null-values/m-p/551689#M156550 <P>I am trying to trend NULL values over time. There are 12 fields in total. I am attempting to get it to trend by day where it shows the fields that are NULL with and the counts for those fields, in addition to a percentage of ones that were not NULL. I can provide the output I get on Monday but I think it might be better to take a step back and see if anyone has an idea for a better way to do this.</P> Sat, 15 May 2021 06:17:47 GMT https://community.splunk.com/t5/Splunk-Search/Timecharting-null-values/m-p/551689#M156550 bspargur 2021-05-15T06:17:47Z https://community.splunk.com/t5/Splunk-Search/Timecharting-null-values/m-p/551690#M156551 <LI-CODE lang="markup">| gentimes start=-30 increment=1h | rename starttime as _time | fields _time | eval fielda="a".mvindex(split("ABC",""),random()%4) | eval fieldb="b".mvindex(split("ABC",""),random()%4) | eval fieldc="c".mvindex(split("ABC",""),random()%4) | eval fieldd="d".mvindex(split("ABC",""),random()%4) | eval fielde="e".mvindex(split("ABC",""),random()%4) | eval fieldf="f".mvindex(split("ABC",""),random()%4) | foreach * [| eval null_&lt;&lt;FIELD&gt;&gt;=if(isnull(&lt;&lt;FIELD&gt;&gt;),1,null)] | timechart span=1d sum(null_*) as null_*</LI-CODE> Sat, 15 May 2021 08:01:27 GMT https://community.splunk.com/t5/Splunk-Search/Timecharting-null-values/m-p/551690#M156551 ITWhisperer 2021-05-15T08:01:27Z https://community.splunk.com/t5/Splunk-Search/Timecharting-null-values/m-p/552124#M156688 <P>Thank you. This is a very nice solution.&nbsp;</P> Wed, 19 May 2021 03:15:11 GMT https://community.splunk.com/t5/Splunk-Search/Timecharting-null-values/m-p/552124#M156688 bspargur 2021-05-19T03:15:11Z