https://community.splunk.com/t5/Splunk-Search/How-to-remove-missing-value-timestamps-for-accurate-delta/m-p/695437#M236476 <P>HI,</P> <P>I'm running a search for two different timeranges, for missing datapoint pair it's creating discrepancy with my calculations.<BR />I need accurate diff so fillnull value is not an option, I would prefer want to remove _time row if it's missing a pair for the same timestamp, any hints appreciated.</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="timedelta.png" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/32081iF0BB554C11EFEC6A/image-size/large?v=v2&amp;px=999" role="button" title="timedelta.png" alt="timedelta.png" /></span></P> <P>Got an idea with below but despite moving around my stats&nbsp;<BR /><BR /></P> <LI-CODE lang="markup">| stats count values(marker) as pairstamp by _time | where count=2</LI-CODE> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="count2.png" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/32082i028AC091178AD8C9/image-size/large?v=v2&amp;px=999" role="button" title="count2.png" alt="count2.png" /></span></P> Tue, 06 Aug 2024 17:41:52 GMT Bart 2024-08-06T17:41:52Z https://community.splunk.com/t5/Splunk-Search/How-to-remove-missing-value-timestamps-for-accurate-delta/m-p/695437#M236476 <P>HI,</P> <P>I'm running a search for two different timeranges, for missing datapoint pair it's creating discrepancy with my calculations.<BR />I need accurate diff so fillnull value is not an option, I would prefer want to remove _time row if it's missing a pair for the same timestamp, any hints appreciated.</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="timedelta.png" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/32081iF0BB554C11EFEC6A/image-size/large?v=v2&amp;px=999" role="button" title="timedelta.png" alt="timedelta.png" /></span></P> <P>Got an idea with below but despite moving around my stats&nbsp;<BR /><BR /></P> <LI-CODE lang="markup">| stats count values(marker) as pairstamp by _time | where count=2</LI-CODE> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="count2.png" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/32082i028AC091178AD8C9/image-size/large?v=v2&amp;px=999" role="button" title="count2.png" alt="count2.png" /></span></P> Tue, 06 Aug 2024 17:41:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-remove-missing-value-timestamps-for-accurate-delta/m-p/695437#M236476 Bart 2024-08-06T17:41:52Z https://community.splunk.com/t5/Splunk-Search/How-to-remove-missing-value-timestamps-for-accurate-delta/m-p/695439#M236478 <P>my search is:<BR />earliest="4/1/2024:00:00:00" latest="8/1/2024:00:00:00"</P> <LI-CODE lang="markup">| bin span=1h _time | addinfo | eval marker = if(_time &lt; (relative_time(info_min_time,"+1mon@mon")), "April", "July") | eval _time = if(_time &lt; (relative_time(info_min_time,"+1mon@mon")), _time + 91*24*3600, _time) ... | where _time&gt;=relative_time(now(), "-1mon@mon") | stats max(sig_value) as signature by _time marker | delta signature as diff_delta</LI-CODE> Tue, 06 Aug 2024 17:43:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-remove-missing-value-timestamps-for-accurate-delta/m-p/695439#M236478 Bart 2024-08-06T17:43:00Z https://community.splunk.com/t5/Splunk-Search/How-to-remove-missing-value-timestamps-for-accurate-delta/m-p/695441#M236479 <P>Try using eventstats</P><LI-CODE lang="markup">| eventstats count by _time | where count=2</LI-CODE> Tue, 06 Aug 2024 16:24:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-remove-missing-value-timestamps-for-accurate-delta/m-p/695441#M236479 ITWhisperer 2024-08-06T16:24:17Z