Dashboards & Visualizations

How to remove null values from chart

stefan1988
Path Finder

Hello,

How could I exclude rows where one out of two domains is showing a null value?

My search is:
| chart avg(time_taken) over uri by domainname

For example I get the following result

Uri | DomainA | DomainB

uri1 1.1 1.2
uri2 2.1
uri3 1.8 0.4

uri2 is having one null value. I would like to exclude the row for uri2.

Many thanks.

Tags (1)
0 Karma
1 Solution

masonmorales
Influencer

Try

... | eventstats dc(domainname) as doman_count | search domain_count>=2| chart avg(time_taken) over uri by domainname

View solution in original post

masonmorales
Influencer

Try

... | eventstats dc(domainname) as doman_count | search domain_count>=2| chart avg(time_taken) over uri by domainname

stefan1988
Path Finder

alt text

I've tried with eventstats, but I still see rows with null values.

0 Karma

starcher
Influencer

if you simply want to drop rows with either column having a null. you could do something like

... | where isnotnull(DomainA) AND isnotnull(DomainB)
0 Karma

stefan1988
Path Finder

Both DomainA and DomainB are values (and not fields). Found the answer, it's possible with the following search:

index=in_oracle_soa sourcetype=oracle_soa_server_accesslog NOT "#" | rex "(?<c_ip>[^\t]+)\t(?<datum>[^\t]+)\t(?<tijd>[^\t]+)\t(?<method>[^\t]+)\t(?<uri>[^\t]+)\t(?<status_code>[^\t]+)\t(?<bytes>[^\t]+)\t(?<time_taken>[^\t]+)" |stats avg(time_taken) as "avg" by uri domainname |eventstats dc(domainname) as uniqvalues by uri | where uniqvalues>1 |xyseries uri,domainname,avg
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...