topic How to chart eventless days without losing drilldown after a _time field format? in Splunk Search

How to chart eventless days without losing drilldown after a _time field format?

alemarzu — Wed, 17 Sep 2014 14:04:47 GMT

Hi there fellas,

I'm having troubles trying to chart eventless days when they are the first events to plot in a chronological order. What I'm trying to say is, if I want to chart from day 1 to 15, and let's say 1-2-3 are empty my chart starts from day 4.

My first attempt was "kinda okey", but since I've formatted _time field I couldn't drilldown anymore.

my_search | timechart count span=1d | rename _time AS Time, count as Quantity | eval Time=strftime(Time, "%d-%m")

In my second attempt, I was able to drilldown but couldn't chart first eventless days.

my_search | eval Time = _time | chart count as Quantity by Time span=1d | eval Time=strftime(Time, "%d-%m")

Sidenote: fillnull & makecontinuous didn't work. I've also tried to append fake data but I couldn't make it happen

What am I doing wrong ? Any help would be greatly appreciated.

EDIT: Recently I've created a dashboard and tried to drilldown to another form to avoid this but I'm facing the same issue. Formatted _time field = 0 events when drilldown.

Re: How to chart eventless days without losing drilldown after a _time field format?

Ayn — Wed, 17 Sep 2014 14:32:20 GMT

Any specific reason why you're not using timechart? It seems you're doing exactly what timechart would do but are missing the extra thing that timechart also does, which is include periods with no events. Using timechart, your search could be rewritten to simply this:

my_search | timechart span=1d count as Quantity

Re: How to chart eventless days without losing drilldown after a _time field format?

alemarzu — Wed, 17 Sep 2014 15:10:44 GMT

Ayn,

I understand what you are suggesting, but I'm not using timechart because I was trying to show %d-%m" for each day under the x-axis, and when I format _time field to do that, drilldown doesn't work anymore. Besides that there's no other reason.

Any other idea/solution ?

Re: How to chart eventless days without losing drilldown after a _time field format?

Jeff_Lightly_Sp — Fri, 19 Sep 2014 15:46:11 GMT

I don't have data to test this right now but would usenull=f work?

chart count as Quantity by Time usenull=f span=1d

Re: How to chart eventless days without losing drilldown after a _time field format?

alemarzu — Fri, 19 Sep 2014 18:16:07 GMT

Nope Jeff, it won't work.

Main problem actually is to format _time the way I want without losing drilldown because right now returns 0 results, and If i don't, it works.

Re: How to chart eventless days without losing drilldown after a _time field format?

alemarzu — Fri, 26 Sep 2014 14:57:27 GMT

Perhaps there's another way to accomplish what I'm looking for ? Is it possible ?

Wanted outcome; Plot count(y-axis) of events over days(x-axis), eventless days also. And format time to "%d-%m" without losing drilldown in the process.

In my previous attempts after formatting _time, drilldown returns 0 results.

Re: How to chart eventless days without losing drilldown after a _time field format?

alemarzu — Fri, 26 Sep 2014 16:30:52 GMT

I've made it.

I did not replace my old timechart query, what I did was a simple drilldown redirection. Something like this.

 <drilldown target="_blank">
   <link>
     <![CDATA[search?q="my_main_search"&earliest=$token.earliest$&latest=$token.latest$]>
   </link>
 </drilldown>