https://community.splunk.com/t5/Splunk-Search/If-I-only-have-transaction-data-from-8AM-to-6PM-how-do-I-display/m-p/154322#M43402 <P>I have data (transactions data) which shows 8 AM to 6 PM, but I need to show a report from 00 hrs to 24 hrs. I tried <CODE>timechart span=1hr</CODE> and <CODE>fillnull value=NULL</CODE>, but it's filling only null values in between 8 AM to 6 PM. I need timechart for the entire 24 hrs.</P> Tue, 04 Aug 2015 15:54:33 GMT jkponnuri 2015-08-04T15:54:33Z https://community.splunk.com/t5/Splunk-Search/If-I-only-have-transaction-data-from-8AM-to-6PM-how-do-I-display/m-p/154322#M43402 <P>I have data (transactions data) which shows 8 AM to 6 PM, but I need to show a report from 00 hrs to 24 hrs. I tried <CODE>timechart span=1hr</CODE> and <CODE>fillnull value=NULL</CODE>, but it's filling only null values in between 8 AM to 6 PM. I need timechart for the entire 24 hrs.</P> Tue, 04 Aug 2015 15:54:33 GMT https://community.splunk.com/t5/Splunk-Search/If-I-only-have-transaction-data-from-8AM-to-6PM-how-do-I-display/m-p/154322#M43402 jkponnuri 2015-08-04T15:54:33Z https://community.splunk.com/t5/Splunk-Search/If-I-only-have-transaction-data-from-8AM-to-6PM-how-do-I-display/m-p/154323#M43403 <P>So if I'm understanding you correctly - you have data between 8am-6pm, but want to show a timechart from 00-24hr, where data that doesn't exist gets a null value as a "placeholder value".</P> <P>try: <CODE>| timechart span=1h count | appendpipe [|stats count |addinfo | eval temp=info_min_time."##".info_max_time | makemv temp delim="##" | mvexpand temp | eval count=0 | eval _time=temp | table _time count] | timechart span=1h sum(count) as count | fillnull</CODE></P> <P>This will give those hours that have no data a 0 value. </P> Tue, 04 Aug 2015 17:27:57 GMT https://community.splunk.com/t5/Splunk-Search/If-I-only-have-transaction-data-from-8AM-to-6PM-how-do-I-display/m-p/154323#M43403 jnussbaum_splun 2015-08-04T17:27:57Z https://community.splunk.com/t5/Splunk-Search/If-I-only-have-transaction-data-from-8AM-to-6PM-how-do-I-display/m-p/154324#M43404 <P>Hi. Thanks for the answer but it didn't show 24 hrs. Actually I am calculating transaction per second in an hour. And showing in a timechart with only peak transactions in that hour for entire 24 hours.</P> <P>Here I tried...<BR /> Source=ABC field1="xyz" | timechart span=1s count as req_per_second | timechart span=1hr max(req_per_second) as max | fillnull value=0 | table _time max</P> Tue, 29 Sep 2020 06:52:52 GMT https://community.splunk.com/t5/Splunk-Search/If-I-only-have-transaction-data-from-8AM-to-6PM-how-do-I-display/m-p/154324#M43404 jkponnuri 2020-09-29T06:52:52Z https://community.splunk.com/t5/Splunk-Search/If-I-only-have-transaction-data-from-8AM-to-6PM-how-do-I-display/m-p/154325#M43405 <P>This should do the task for you</P> <PRE><CODE>source=ABC field1="xyz" | timechart span=1s count as req_per_second | timechart span=1hr max(req_per_second) as max | appendpipe [| gentimes start=-1 | addinfo | eval temp=info_min_time." ".info_max_time | table temp| makemv temp | mvexpand temp | rename temp as _time ] | timechart span=1h max(max) as max | makecontinuous | fillnull value=0 </CODE></PRE> Wed, 05 Aug 2015 03:20:01 GMT https://community.splunk.com/t5/Splunk-Search/If-I-only-have-transaction-data-from-8AM-to-6PM-how-do-I-display/m-p/154325#M43405 somesoni2 2015-08-05T03:20:01Z https://community.splunk.com/t5/Splunk-Search/If-I-only-have-transaction-data-from-8AM-to-6PM-how-do-I-display/m-p/154326#M43406 <P>Thanks for the answer, I am not sure where is the wrong... I am receiving time from 1970. <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> is there any change we can do to display only 24 hr data. Thanks again.</P> Wed, 05 Aug 2015 03:59:03 GMT https://community.splunk.com/t5/Splunk-Search/If-I-only-have-transaction-data-from-8AM-to-6PM-how-do-I-display/m-p/154326#M43406 jkponnuri 2015-08-05T03:59:03Z https://community.splunk.com/t5/Splunk-Search/If-I-only-have-transaction-data-from-8AM-to-6PM-how-do-I-display/m-p/154327#M43407 <P>What time range did you select while running the query? I guess you're running for All Time causing the info_min_time to go back to 1970. I suppose you should select some finite time range like Yesterday, last 7 days etc.</P> Tue, 29 Sep 2020 06:52:58 GMT https://community.splunk.com/t5/Splunk-Search/If-I-only-have-transaction-data-from-8AM-to-6PM-how-do-I-display/m-p/154327#M43407 somesoni2 2020-09-29T06:52:58Z https://community.splunk.com/t5/Splunk-Search/If-I-only-have-transaction-data-from-8AM-to-6PM-how-do-I-display/m-p/154328#M43408 <P>EXCELLENT!!! I got results as expected. Thanks a ton....</P> Wed, 05 Aug 2015 04:36:04 GMT https://community.splunk.com/t5/Splunk-Search/If-I-only-have-transaction-data-from-8AM-to-6PM-how-do-I-display/m-p/154328#M43408 jkponnuri 2015-08-05T04:36:04Z https://community.splunk.com/t5/Splunk-Search/If-I-only-have-transaction-data-from-8AM-to-6PM-how-do-I-display/m-p/154329#M43409 <P>Also. Can you help, If I need for one hour timechart with complete 60 mins info to display? </P> Wed, 05 Aug 2015 06:44:12 GMT https://community.splunk.com/t5/Splunk-Search/If-I-only-have-transaction-data-from-8AM-to-6PM-how-do-I-display/m-p/154329#M43409 jkponnuri 2015-08-05T06:44:12Z