topic Stacked timechart of accumulative count with missing values? in Splunk Search

Stacked timechart of accumulative count with missing values?

noambz — Mon, 28 Sep 2020 13:33:45 GMT

Hi,

I have the following search which generates the data below:

some_search | bucket _time span=1h | stats count as total_count by _time gender | streamstats sum(total_count) as acc_count by gender.

time/gender/count/acc_count

2/21/13 9:00:00.000 PM female 1 1

2/21/13 9:00:00.000 PM male 1 1

2/22/13 9:00:00.000 PM female 1 2

2/22/13 9:00:00.000 PM male 1 2

2/22/13 7:00:00.000 PM female 1 3

2/23/13 9:00:00.000 PM male 2 4

2/24/13 9:00:00.000 PM male 1 5

When I chart it with:

| timechart span=1d max(acc_count) by gender

I have a problem on the 23rd and 24th because there are no females and therefore the stacked chart shows nothing.
I am trying to show accumulative values so the chart should show 3 females on the 23rd and 24th like on the 22nd.

Anyone have an idea?

Re: Stacked timechart of accumulative count with missing values?

noambz — Wed, 20 Mar 2013 21:35:34 GMT

Struggled with this for many hours but found the answer 20 min after posting....

filldown command did the trick!

Re: Stacked timechart of accumulative count with missing values?

martin_mueller — Wed, 20 Mar 2013 21:37:56 GMT

As an alternative, you can simplify your search a lot:

some search | timechart span=1d count as total_count by gender | streamstats sum(*) as *

No filldown needed.

Re: Stacked timechart of accumulative count with missing values?

noambz — Wed, 20 Mar 2013 21:55:09 GMT

Great.
Didn't know about that * option.
That did the trick and is much simpler!