topic Re: Add a Line into a TimeChart in Splunk Search

Add a Line into a TimeChart

quatral — Fri, 05 Oct 2012 14:12:12 GMT

Hi,

I'm trying to develop a TIMECHART that represent a Download/Upload bandtwidth from bandwidthd log. The TIMECHART should have total bandwidth for each months of the year and a line representing the limit per month.

I've try to make an EVAL that set a value to that limit, heres the code:

host="x" sourcetype="bandwidthd" | EVAL val_total_giga_bytes_limit=80 | EVAL val_total_giga_bytes_sent=cus_bndw_total_bytes_sent/1024/1024/1024 | TIMECHART SPAN=1month sum(val_total_giga_bytes_sent) AS "Giga-Octet envoyé" avg(val_total_giga_bytes_limit) AS "Limite"

The problem is, when I've got NULL value (on my test only September as events log), the "Limit" doesn't show properly.

Is there any options somewhere that could be done? I've tried in dashboard with the Null Value manage as zero but I just want the SUM to be at zero but the AVG still set at 80.

Sorry for my poor english skills.

Drew

Re: Add a Line into a TimeChart

kristian_kolb — Fri, 05 Oct 2012 20:08:43 GMT

Have you tried fillnull (if your 'bad' events look like a= b= c= etc)

host="x" sourcetype="bandwidthd" 
| eval GB_limit=80 
| fillnull cus_bndw_total_bytes_sent
| eval GB_sent = cus_bndw_total_bytes_sent/1024/1024/1024 
| timechart span=1month sum(GB_sent) AS "Giga-Octet envoyé" avg(GB_limit) AS "Limite"

or if the 'bad' events look like a=NULL b=NULL etc, then use

replace NULL with 0 in cus_bndw_total_bytes_sent

instead of fillnull

http://docs.splunk.com/Documentation/Splunk/4.3.4/SearchReference/Replace
http://docs.splunk.com/Documentation/Splunk/4.3.4/SearchReference/Fillnull

Hope this helps,

Kristian

Re: Add a Line into a TimeChart

quatral — Mon, 28 Sep 2020 12:35:29 GMT

Hi Kristian, the problem is not the cus_bndw_total_bytes_sent but the GB_limit (in your exemple). I'm making a timechart for a year but I only have data for two months. I want GB_limit to be at 80 for all the 12 months even if there is no data loged.

but I got a "Error in 'fillnull' command: Invalid argument: '='".

Re: Add a Line into a TimeChart

quatral — Tue, 09 Oct 2012 14:11:32 GMT

replace all the GB_limit = 1 by 80