topic Re: timechart: fill values in empty slots in Splunk Search

timechart: fill values in empty slots

zaphod1984 — Thu, 27 Nov 2014 12:43:45 GMT

Assuming I have the following log entries

2014-11-01 foo=bar
2014-11-02 foo=bax

With the search | timechart span=1d count only the days get plottet where actually an entries exists, but not on that days that have been happening since the last entry and now.
Is there a simple way to fill those gaps?

Re: timechart: fill values in empty slots

MuS — Thu, 27 Nov 2014 12:50:07 GMT

Hi zaphod1984,

take a look at this answer to get more details
http://answers.splunk.com/answers/176466/how-to-use-eval-if-there-is-no-result-from-the-bas-1.html

but you can do something like this:

... | stats count AS myCount by foo, _time | timechart span=1d sum(myCount) AS count

this way you would get a 0 for days with no events.

hope this helps ...

cheers, MuS

Re: timechart: fill values in empty slots

zaphod1984 — Thu, 27 Nov 2014 13:04:31 GMT

that's it, thanks!
i was hoping that there would be some kind of a parameter for timechart...

Re: timechart: fill values in empty slots

zaphod1984 — Thu, 27 Nov 2014 13:13:52 GMT

any ideas on how to accompilish this when it comes to averages, medians etc. instead of a simple count?

Re: timechart: fill values in empty slots

MuS — Thu, 27 Nov 2014 13:16:35 GMT

take a look at the docs http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/CommonStatsFunctions for all available functions for timechart

Re: timechart: fill values in empty slots

zaphod1984 — Thu, 27 Nov 2014 14:50:16 GMT

hi i know the methods that are available but a search like this would not be accurate anymore when using the approach mentioned above: ... | stats p90(foo) AS myP90Foo _time | timechart span=1d p90(myP90Foo) AS p90Foo

Re: timechart: fill values in empty slots

MuS — Thu, 27 Nov 2014 15:14:09 GMT

the stats is only there to create empty event counts not to do any aggregation or such, do all this in your timechart