https://community.splunk.com/t5/Splunk-Search/Results-for-each-minute-in-an-hour-even-if-there-s-no-data/m-p/327224#M166149 <P>Hey, </P> <P>can you please tell me what is info_min_time and info_max_time?</P> Tue, 29 Sep 2020 15:43:25 GMT patilsh 2020-09-29T15:43:25Z https://community.splunk.com/t5/Splunk-Search/Results-for-each-minute-in-an-hour-even-if-there-s-no-data/m-p/327217#M166142 <P>Hello All,</P> <P>Suppose I want a search results for past 60minutes, how spunk works now is if there is any event in past 60mins then that is displayed.</P> <P>But what i want is Suppose time is 4pm and I give past 60mins, Splunk should start the data from 4:00, 4:01...... and so on till 5:00 irrespective of data is present or not, if data is not present then the result should give time with corresponding columns blank.</P> <P>Can someone please help mw on this.</P> Fri, 08 Sep 2017 21:18:53 GMT https://community.splunk.com/t5/Splunk-Search/Results-for-each-minute-in-an-hour-even-if-there-s-no-data/m-p/327217#M166142 patilsh 2017-09-08T21:18:53Z https://community.splunk.com/t5/Splunk-Search/Results-for-each-minute-in-an-hour-even-if-there-s-no-data/m-p/327218#M166143 <P>Hey @patilsh, The comments on this post show each count by minute and then a second comment explains how to show the minutes without values<BR /> <A href="https://answers.splunk.com/answers/227568/how-to-edit-my-search-to-return-one-count-for-each.html">https://answers.splunk.com/answers/227568/how-to-edit-my-search-to-return-one-count-for-each.html</A></P> Fri, 08 Sep 2017 21:39:36 GMT https://community.splunk.com/t5/Splunk-Search/Results-for-each-minute-in-an-hour-even-if-there-s-no-data/m-p/327218#M166143 lfedak_splunk 2017-09-08T21:39:36Z https://community.splunk.com/t5/Splunk-Search/Results-for-each-minute-in-an-hour-even-if-there-s-no-data/m-p/327219#M166144 <P>If it's 4pm and you say 'past 60mins', Splunk will return data from 3pm-4pm. Not sure I understand what you are trying to do.</P> Fri, 08 Sep 2017 22:04:38 GMT https://community.splunk.com/t5/Splunk-Search/Results-for-each-minute-in-an-hour-even-if-there-s-no-data/m-p/327219#M166144 s2_splunk 2017-09-08T22:04:38Z https://community.splunk.com/t5/Splunk-Search/Results-for-each-minute-in-an-hour-even-if-there-s-no-data/m-p/327220#M166145 <P>Just add this:</P> <PRE><CODE>| timechart span=1m count </CODE></PRE> Fri, 08 Sep 2017 22:06:12 GMT https://community.splunk.com/t5/Splunk-Search/Results-for-each-minute-in-an-hour-even-if-there-s-no-data/m-p/327220#M166145 woodcock 2017-09-08T22:06:12Z https://community.splunk.com/t5/Splunk-Search/Results-for-each-minute-in-an-hour-even-if-there-s-no-data/m-p/327221#M166146 <P>If I follow the desired outcome he would need to include <STRONG>usenull</STRONG><BR /> so something like: <BR /> | timechart usenull=1 span=1m count</P> Sat, 09 Sep 2017 23:32:47 GMT https://community.splunk.com/t5/Splunk-Search/Results-for-each-minute-in-an-hour-even-if-there-s-no-data/m-p/327221#M166146 mtranchita 2017-09-09T23:32:47Z https://community.splunk.com/t5/Splunk-Search/Results-for-each-minute-in-an-hour-even-if-there-s-no-data/m-p/327222#M166147 <P>That depends on what you mean by "corresponding columns".</P> <P>If you have very sparse events, and are wanting to show the details for the events when they are present, but show blank lines with the _time if they are not, then you can do this...</P> <PRE><CODE>your search | fields field1 field2 field3 field4 | append [|makeresults | addinfo | eval mystart=relative_time(info_min_time,"@m") | eval myend=relative_time(info_max_time,"@m+61s") | eval mytimes=mvrange(mystart,myend,60) | table mytimes | mvexpand mytimes | rename mytimes as _time ] | table _time field1 field2 field3 field4 | fillnulls value="" | stats max(*) as * by _time </CODE></PRE> <P>Some of that is unnecessary if you are using a stats command already,though. </P> <PRE><CODE>your search | fields foo bar | bin _time span=1m | stats count as mycount avg(foo) as avgfoo sum(bar) as sumbar by _time | append [|makeresults | addinfo | eval mystart=relative_time(info_min_time,"@m") | eval myend=relative_time(info_max_time,"@m+61s") | eval mytimes=mvrange(mystart,myend,60) | table mytimes | mvexpand mytimes | rename mytimes as _time | eval mycount = 0 ] | stats sum(mycount) as count max(avgfoo) as avgfoo max(sumbar) as sumbar by _time </CODE></PRE> Sun, 10 Sep 2017 02:55:36 GMT https://community.splunk.com/t5/Splunk-Search/Results-for-each-minute-in-an-hour-even-if-there-s-no-data/m-p/327222#M166147 DalJeanis 2017-09-10T02:55:36Z https://community.splunk.com/t5/Splunk-Search/Results-for-each-minute-in-an-hour-even-if-there-s-no-data/m-p/327223#M166148 <P>time chart gives continuous value after the first entry is found:</P> <P>For example is say present time is 9pm and I want 60minutes ago data, i.e data from 8pm</P> <P>But if the first entry is 8:10pm , timechart will give all the values from 8:10 till 9pm irrespective of data is present or not, but I also want blank entries from 8:00 to 8:10 pm as well</P> Tue, 12 Sep 2017 04:48:05 GMT https://community.splunk.com/t5/Splunk-Search/Results-for-each-minute-in-an-hour-even-if-there-s-no-data/m-p/327223#M166148 patilsh 2017-09-12T04:48:05Z https://community.splunk.com/t5/Splunk-Search/Results-for-each-minute-in-an-hour-even-if-there-s-no-data/m-p/327224#M166149 <P>Hey, </P> <P>can you please tell me what is info_min_time and info_max_time?</P> Tue, 29 Sep 2020 15:43:25 GMT https://community.splunk.com/t5/Splunk-Search/Results-for-each-minute-in-an-hour-even-if-there-s-no-data/m-p/327224#M166149 patilsh 2020-09-29T15:43:25Z