topic Re: How can I include zero/empty count buckets in tables/charts? in Splunk Search

How can I include zero/empty count buckets in tables/charts?

Glenn — Mon, 14 Nov 2011 17:29:17 GMT

I am trying to create a histogram/distribution graph of deal durations, for comparison between where the user is accessing a website from.

This search works more or less OK:

"search that returns reults with deal durations in field totalTime" | chart count(_raw) as "Num Deals" by totalTime span=100

totalTime is returned as an integer 0-3000, meaning ideally I would have 30 buckets. My problem is that some locations are very slow, and there are no durations below 800. The chart command does not create any rows for durations lower than 800 (ie. 0-100, 100-200, 200-300 etc up to 700-800 are all missing). This makes direct comparisons between graphs difficult, as they do not show the same scale.

Is there any way to force Splunk to create empty buckets (starting from zero) for charting as per my requirement?

Splunk version 4.1.5.

Cheers,

Glenn

Re: How can I include zero/empty count buckets in tables/charts?

ytamura — Mon, 14 Nov 2011 18:07:42 GMT

I'm assuming you are bucketing in terms of totalTime. What worked for me is the following search structure:

your search | chart count(totalTime) as "Num Deals" over totalTime span=100

Addendum: There's a function called makecontinuous that is supposed to do this, but I believe it actually just adds one to the bucket, which is somewhat misleading to a wider audience: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Makecontinuous

Re: How can I include zero/empty count buckets in tables/charts?

Glenn — Tue, 15 Nov 2011 09:44:32 GMT

Hi, I don't think this works. It gives me the same kind of picture as before - empty buckets before the first one (ie. 0-100, 100-200 if first result is in 200-300 bucket) are not created or charted.

Re: How can I include zero/empty count buckets in tables/charts?

ytamura — Tue, 15 Nov 2011 18:07:52 GMT

Strange, tried again on a simple search and it works for me. I'm on 4.2 by the way. In fact, I did something like your search and I'm still getting 0 buckets displayed.

The only way I'm not getting any 0 buckets is if I do:
search | bucket X span=100 | chart count by X

Perhaps this is a difference between Splunk versions...

Re: How can I include zero/empty count buckets in tables/charts?

the_wolverine — Thu, 13 Feb 2014 18:32:10 GMT

http://answers.splunk.com/answers/118496/fill-in-0-for-timechart-with-missing-values