topic Re: timechart return 0 if no results found in Splunk Search

timechart return 0 if no results found

amitdaniel — Tue, 17 Apr 2018 07:12:14 GMT

Hi .
I have a sourcetype = Queue and i'm sending the number of messages waiting in the queue .

index=monitoring sourcetype=Qeueue Account=azbcd ( QueueName="test123") | timechart max(MessageCount) as MessageCount span=30minute

But if the number of messages = 0 i'm not sending any data to Splunk ( Actually if i'll not find a solution i'll fix my code to send 0 but i want to avoid that )

Look at the picture you can see that when the messageCount=0 i have a "hole" in the graph .
Is there a way to add if condition or something else that will say if we don't have data put 0 ?

Thanks ,
Amit

Re: timechart return 0 if no results found

p_gurav — Tue, 17 Apr 2018 14:17:04 GMT

You can use Zero option for "Null Values" in Format tab. Refer doc:
https://docs.splunk.com/Documentation/Splunk/7.0.3/Viz/LineAreaCharts#Configuration_options

Re: timechart return 0 if no results found

TISKAR — Wed, 18 Apr 2018 12:32:36 GMT

Hello,
Can you try this please,

index=monitoring sourcetype=Qeueue Account=azbcd ( QueueName="test123") | timechart max(MessageCount) as MessageCount span=30minute | fillnull value=0

Also you can use make continous command:

https://docs.splunk.com/Documentation/Splunk/7.0.3/SearchReference/Makecontinuous

Regards

Re: timechart return 0 if no results found

amitdaniel — Wed, 18 Apr 2018 14:15:45 GMT

Thank you !

Re: timechart return 0 if no results found

niketn — Wed, 18 Apr 2018 14:36:12 GMT

The command equivalent for this would be | fillull value=0 to be added after the timechart command.