https://community.splunk.com/t5/Splunk-Search/Can-we-set-different-charting-nullValueMode-for-different-chart/m-p/34563#M7477 <P>sourcetype="agent" <BR /> | spath path="EID" output=EventID <BR /> | search EventID=3<BR /> | spath path="SID" output=SID<BR /> |search SID="aaa-bbb" <BR /> | spath path="MU" output=mu <BR /> | eval mu=(mu/1024)|eval mu=round(mu,2)<BR /> | timechart first(mu) as "Memory Usage(MB)"|appendcols [search sourcetype="agent" <BR /> | spath path="EID" output=EventID <BR /> | search EventID=3<BR /> | spath path="SID" output=SID<BR /> |search SID="aaa-bbb" |spath path="DBG" output=Debug |eval n=25|timechart first(n) by Debug]</P> <OL> <LI><P>I want for first timechart null values "connect" and for second one I need nullvalues "gap" or I need column chart for second timechart.<BR /> I am trying <OBJECT><PARAM name="charting.chart" />line<BR /> <PARAM name="charting.chart2" />column<BR /> <PARAM name="charting.chart.nullValueMode" />connect<BR /> OR<BR /> <PARAM name="charting.chart" />line<BR /> <PARAM name="charting.chart.nullValueMode" />connect<BR /> <PARAM name="charting.chart2.nullValueMode" />gap<BR /> Nothing is working. Please help.</OBJECT></P></LI> <LI><P>Also I need to filter results where Debug!="{}" <BR /> Any Suggestion Please?This is urgent.</P></LI> </OL> Fri, 15 Feb 2013 21:41:00 GMT disha 2013-02-15T21:41:00Z https://community.splunk.com/t5/Splunk-Search/Can-we-set-different-charting-nullValueMode-for-different-chart/m-p/34563#M7477 <P>sourcetype="agent" <BR /> | spath path="EID" output=EventID <BR /> | search EventID=3<BR /> | spath path="SID" output=SID<BR /> |search SID="aaa-bbb" <BR /> | spath path="MU" output=mu <BR /> | eval mu=(mu/1024)|eval mu=round(mu,2)<BR /> | timechart first(mu) as "Memory Usage(MB)"|appendcols [search sourcetype="agent" <BR /> | spath path="EID" output=EventID <BR /> | search EventID=3<BR /> | spath path="SID" output=SID<BR /> |search SID="aaa-bbb" |spath path="DBG" output=Debug |eval n=25|timechart first(n) by Debug]</P> <OL> <LI><P>I want for first timechart null values "connect" and for second one I need nullvalues "gap" or I need column chart for second timechart.<BR /> I am trying <OBJECT><PARAM name="charting.chart" />line<BR /> <PARAM name="charting.chart2" />column<BR /> <PARAM name="charting.chart.nullValueMode" />connect<BR /> OR<BR /> <PARAM name="charting.chart" />line<BR /> <PARAM name="charting.chart.nullValueMode" />connect<BR /> <PARAM name="charting.chart2.nullValueMode" />gap<BR /> Nothing is working. Please help.</OBJECT></P></LI> <LI><P>Also I need to filter results where Debug!="{}" <BR /> Any Suggestion Please?This is urgent.</P></LI> </OL> Fri, 15 Feb 2013 21:41:00 GMT https://community.splunk.com/t5/Splunk-Search/Can-we-set-different-charting-nullValueMode-for-different-chart/m-p/34563#M7477 disha 2013-02-15T21:41:00Z https://community.splunk.com/t5/Splunk-Search/Can-we-set-different-charting-nullValueMode-for-different-chart/m-p/34564#M7478 <P>Concerning number one, set the chart to omit null values and compute your own connect for the other chart like this:</P> <PRE><CODE>... | streamstats count(f) as temp | streamstats count by temp | eventstats max(count) as max by temp | streamstats last(f) as last | reverse | streamstats last(f) as next | reverse | eval f = if(isnull(f),last+((next-last)/max)*(count-1),f) | fields - temp count max last next </CODE></PRE> <P>To keep things looking nice, call your first(mu) as f at first, and later rename it - else you'd have the human-readable field all over the query.</P> <P>Concerning number two, something like this?</P> <PRE><CODE>... | where Debug!="{}" </CODE></PRE> Sat, 16 Feb 2013 00:08:56 GMT https://community.splunk.com/t5/Splunk-Search/Can-we-set-different-charting-nullValueMode-for-different-chart/m-p/34564#M7478 martin_mueller 2013-02-16T00:08:56Z