topic Re: How to hide time without values in timechart in Splunk Search

How to hide time without values in timechart

alvaromoraes — Thu, 24 Jan 2013 16:04:14 GMT

Hello comunity,

I need help to hide a value unavailable in a timechart. I searched for some functions, but I have no sucess trying.

Please, see the image below:

I don't want the time column "13:00" appearing in timechart, 'cause i don't have results yet (my database query get results with an interval of 15 minutes). You know anything to hide it until results are avaiable?

My search:

sourcetype="backlog_baonline" | timechart span=1h max(TOTAL) by ACTIVITY limit=100 | rename _time AS Time | eval Time=strftime(Time, "%H:%M")

Time range: -4h to now

I tried usenull=f useother=f, but it didn't work for my purpose.

Thank you in advance!

Re: How to hide time without values in timechart

chris — Fri, 25 Jan 2013 01:03:50 GMT

Have you tried playing with the end time of your search? sourcetype="backlog_baonline" earliest=-4h latest=-1h | timechart span=1h max(TOTAL) by ACTIVITY limit=100 | rename _time AS Time | eval Time=strftime(Time, "%H:%M")

Re: How to hide time without values in timechart

martin_mueller — Fri, 25 Jan 2013 08:18:45 GMT

Something like this?

...  | timechart count | reverse | accum count as total_count | reverse | where total_count > 0 | fields - total_count

Re: How to hide time without values in timechart

alvaromoraes — Tue, 29 Jan 2013 18:15:43 GMT

Yes, I tried to modify the time range like you said, but it didn't work. The column without any results always appear in the chart.

Thanks for the answer.

Re: How to hide time without values in timechart

alvaromoraes — Tue, 29 Jan 2013 18:21:40 GMT

I tried your suggestion in my source, same problem. I hate this empty column! haha

Thanks for the answer.