https://community.splunk.com/t5/Splunk-Search/How-to-delete-data-points-with-null-values-by-host-to-produce-a/m-p/221489#M65105 <P>Hello,</P> <P>I want to delete the time point if there is the one or more host max(time)&gt;avg(time)+5 at that point in time. Now, just let the point become null if max(time)&gt;avg(time)+5. How to delete the time point if there are &gt;=1 null? I hope I can have the continuous linear graph.<BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/2128i49F22CCF022CB9A3/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span><BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/2129i9D7C9D1724EA12ED/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Wed, 16 Nov 2016 02:43:34 GMT serenalin 2016-11-16T02:43:34Z https://community.splunk.com/t5/Splunk-Search/How-to-delete-data-points-with-null-values-by-host-to-produce-a/m-p/221489#M65105 <P>Hello,</P> <P>I want to delete the time point if there is the one or more host max(time)&gt;avg(time)+5 at that point in time. Now, just let the point become null if max(time)&gt;avg(time)+5. How to delete the time point if there are &gt;=1 null? I hope I can have the continuous linear graph.<BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/2128i49F22CCF022CB9A3/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span><BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/2129i9D7C9D1724EA12ED/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Wed, 16 Nov 2016 02:43:34 GMT https://community.splunk.com/t5/Splunk-Search/How-to-delete-data-points-with-null-values-by-host-to-produce-a/m-p/221489#M65105 serenalin 2016-11-16T02:43:34Z https://community.splunk.com/t5/Splunk-Search/How-to-delete-data-points-with-null-values-by-host-to-produce-a/m-p/221490#M65106 <P>If its really about connecting the dots so that your line chart is not broken then why don't you try the Format Visualization option which can give you options to make your graph continuous on finding nulls. Reason I suggest so is if you delete a particular time point based on a single null value for one line, then all the other lines will end up deleting the value for that point, which might not be desirable. Achieve the connecting the Null dots as follows:</P> <P>Select line chart/graph in your Visualization and then <CODE>Click on Pen Tool (Format) &gt; General &gt; Null Values &gt; &gt; (Gaps| Zero | Connect)</CODE></P> <P>Where <CODE>Gaps</CODE> is your current scenario<BR /> <CODE>Zero</CODE> will <CODE>plot 0 for null</CODE> values<BR /> <CODE>Connect</CODE> will just <CODE>connect past the null</CODE></P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/2126iDBCDFEED3AFC1ABE/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/2127i219B770F4290252C/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Wed, 16 Nov 2016 04:04:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-delete-data-points-with-null-values-by-host-to-produce-a/m-p/221490#M65106 gokadroid 2016-11-16T04:04:50Z