topic Re: How to remove results which are 0 in my timechart search? in Splunk Search

How to remove results which are 0 in my timechart search?

khilawar4 — Mon, 23 Jan 2017 20:14:44 GMT

I am trying to find out the index usage per day and getting total usage at the end as well. but if i want to remove all the column from search result which are 0. how to do that?

index=_internal metrics kb group="per_index_thruput" NOT series=_* NOT series="*summary*" host=*appblx*
| eval totalMB = kb /1024
| eval totalGB = round(totalMB /1024, 2)
| timechart useother=f limit=0 span=1d sum(totalGB) as total by series  |addtotals fieldname=TotaldailyUsageinGB

Re: How to remove results which are 0 in my timechart search?

DalJeanis — Mon, 23 Jan 2017 21:03:52 GMT

Depends on what you mean. Are you trying to remove series whose values are zero, or remove dates which have no activity, or what?

Re: How to remove results which are 0 in my timechart search?

khilawar4 — Mon, 23 Jan 2017 21:07:10 GMT

I am trying to remove output columns (series) whose values are 0

Re: How to remove results which are 0 in my timechart search?

somesoni2 — Mon, 23 Jan 2017 21:07:32 GMT

Give this a try

index=_internal metrics kb group="per_index_thruput" NOT series=_* NOT series="*summary*" host=*appblx*
| eval totalGB = round(kb /1024/1024,2)
| bucket span=1d _time
| chart sum(totalGB) as total by _time series limit=0 |addtotals fieldname=TotaldailyUsageinGB

Re: How to remove results which are 0 in my timechart search?

khilawar4 — Mon, 23 Jan 2017 21:14:12 GMT

Still same.

Re: How to remove results which are 0 in my timechart search?

khilawar4 — Tue, 29 Sep 2020 12:31:35 GMT

below query worked for me , added "where" condition.

index=internal metrics kb group="per_index_thruput" NOT series=* NOT series="summary" host=appblx
| eval totalGB = round(kb/1024/1024,2) | where totalGB > 0
| bucket span=1d _time
| chart sum(totalGB) as total by _time series limit=0 |addtotals fieldname=TotaldailyUsageinGB

Re: How to remove results which are 0 in my timechart search?

dbcase — Mon, 23 Jan 2017 21:22:17 GMT

How about this?

 index=_internal metrics kb group="per_index_thruput" NOT series=_* NOT series="*summary*" host=*appblx*
 | eval totalMB = kb /1024
 | eval totalGB = round(totalMB /1024, 2)
 | timechart useother=f limit=0 span=1d sum(totalGB) as total by series  |where total>0|addtotals fieldname=TotaldailyUsageinGB

Re: How to remove results which are 0 in my timechart search?

rjthibod — Mon, 23 Jan 2017 21:31:43 GMT

Try this

| index=_internal metrics kb group="per_index_thruput" NOT series=_* NOT series="*summary*" host=*appblx*
| bin _time span=1d
| chart limit=0 eval(round(sum(kb)/1024/1024,2)) by _time series
| foreach * [eval "<<FIELD>>" = if (isnull('<<FIELD>>') OR '<<FIELD>>' = 0, null(), '<<FIELD>>')]
| addtotals fieldname=TotaldailyUsageinGB

Re: How to remove results which are 0 in my timechart search?

khilawar4 — Tue, 29 Sep 2020 12:31:38 GMT

thx for the comment .
your query doesn't give result somehow but below query works.

below query worked for me , added "where" condition.

index=internal metrics kb group="per_index_thruput" NOT series=* NOT series="summary" host=appblx
| eval totalGB = round(kb/1024/1024,2) | where totalGB > 0
| bucket span=1d _time
| chart sum(totalGB) as total by _time series limit=0 |addtotals fieldname=TotaldailyUsageinGB