Hello Splunkers!!
As pe the attached screenshot I want to hide values from sep 2022 to july 2023, because those period have a null values. So I want to showcase graph only with values.
You have two issues here - firstly timechart fills in the blanks so even if there isn't any data for the middle days, you will still get zero counts - secondly the chart viz will create a timeline based on _time (whether there is data in the results table or not)
To solve this, firstly, you need to use bin and chart, and secondly you need to create a string field for the time
| bin _time span=1d
| chart <your aggregate function> by _time LiftState
| eval time=strftime(_time, "%F")
| fields time *
| fields - _time
You have two issues here - firstly timechart fills in the blanks so even if there isn't any data for the middle days, you will still get zero counts - secondly the chart viz will create a timeline based on _time (whether there is data in the results table or not)
To solve this, firstly, you need to use bin and chart, and secondly you need to create a string field for the time
| bin _time span=1d
| chart <your aggregate function> by _time LiftState
| eval time=strftime(_time, "%F")
| fields time *
| fields - _time
@ITWhisperer You are a genius.
Change the time range of the search to start in July 2023. That may be within the lift_activity_marco_1d macro.