topic Re: How to use stats group by _time without null fields? in Splunk Search

How to use stats group by _time without null fields?

josefa123 — Thu, 30 Jul 2015 02:26:54 GMT

Here is a screenshot of what I do.

How can I remove null fields and put the values side by side? I am using stats table group by _time to get all the metrics but it seems that metrics are not indexed at the same time and result in blank fields. How can I resolve this issue? Thanks

Re: How to use stats group by _time without null fields?

pradeepkumarg — Thu, 30 Jul 2015 03:00:14 GMT

how does _time look in the above table? you can bucket the events into a specific time range before you do stats . This way all events within that time period are grouped together. Example below which groups all the events in a 5 min window

.. | bucket _time span=5m | stats..

Re: How to use stats group by _time without null fields?

woodcock — Mon, 03 Aug 2015 12:33:34 GMT

The easiest way is to "fudge" the time a bit like this:

Your Original Search up until the stats command here | bucket _time span=5m | stats first (*) AS * BY _time

If you still see some NULL values, keep bumping up 5m until you don't.