topic Re: How to display 0 in a timechart table? in Splunk Search

How to display 0 in a timechart table?

jip31 — Tue, 15 Mar 2022 04:39:50 GMT

hello

I count results by _time in a table panel like this and it works perfectly

When the results is 0 the result is displayed only once there is a result on the bin _time after

For example, if at 7h, the result is = 0 but at 8h the result is = 1, the results for 7h and 8h are correctly displayed

But as long as the result is 0, nothing is displayed

so I tried this for displaying results = 0 but it doesnt works

could you help please?

| eval nbs =if(isnull(nbs, 0, nbs)

Re: help to display 0 in a timechart table

PickleRick — Fri, 11 Mar 2022 11:03:20 GMT

You're doing some strange things here 🙂

Firstly, if you're binning to a full hour, why strftime with minutes? 🙂

Secondly, I'm not sure what you're trying to achieve. Especially with that _time condition - it should be part of the base search.

Can you be a bit more specific what is the goal of this search?

Re: help to display 0 in a timechart table

jip31 — Fri, 11 Mar 2022 11:44:32 GMT

Because I need to display minutes after hour...

Like I said, O is displayed in my table only when there is events on a previous time or an anterior time

for example if at 7h00 there is no event I must wait to have events at 8h00 for having a result = 0 at 7h

Or to have events at 6h00 for having a result = 0 at 7h00

So I am looking for a solution in order to be able to display a result = 0 without wainting a time span with events > 0

Re: help to display 0 in a timechart table

PickleRick — Fri, 11 Mar 2022 12:07:20 GMT

OK, you could have just put a static ":00" since your timestamps are aligned to full hour but this way it will also work 🙂

And about my question what you're trying to do I meant what you're trying to get from your search as a whole. Not what particular technical obstacle you're trying to overcome but what is the "high-level" goal of this search. I mean - what type of report you want to get at the end. What is it supposed to show?

Re: help to display 0 in a timechart table

jip31 — Fri, 11 Mar 2022 12:53:40 GMT

here is what I display

following this example, what I try to explain is that when the nbs field result is 0 I need that the posterior field has a result value in order to display the anterior field which is equal to 0

Imagine that all fields will be equal to 0, it means that there will be any value in my table, just the message "any results"

Re: help to display 0 in a timechart table

jip31 — Fri, 11 Mar 2022 14:34:50 GMT

Like this it's almost working except I ave no time displayed

| appendpipe [ stats count as _events | where _events = 0 | eval nbs = 0 ]

Re: How to display 0 in a timechart table?

somesoni2 — Fri, 11 Mar 2022 20:51:31 GMT

Give this a try

Re: How to display 0 in a timechart table?

jip31 — Mon, 14 Mar 2022 06:16:48 GMT

sorry but any results are displayed

Re: How to display 0 in a timechart table?

jip31 — Tue, 15 Mar 2022 04:08:00 GMT

Is anybody can help please?

Re: How to display 0 in a timechart table?

somesoni2 — Tue, 15 Mar 2022 13:17:50 GMT

Give this a try

Re: How to display 0 in a timechart table?

jip31 — Wed, 16 Mar 2022 06:56:32 GMT

it's a little better it misses 2 things

1) the "Heure" format is not good because I need a display in hour minutes (07:00 instead 07)

2) I just need to display result=0 for the Heure corresponding to the system time (if the system time is 07:00 I need to display 0 only fo 7:00 and not 8:00)

thanks