Dashboards & Visualizations

SPL search: How to showcase graph only with values?

uagraw01
Builder

 

Hello Splunkers!!

As pe the attached screenshot I want to hide values from sep 2022 to july 2023, because those period have a null values. So I want to showcase graph only with values.

uagraw01_0-1694424038559.png

 

Labels (1)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You have two issues here - firstly timechart fills in the blanks so even if there isn't any data for the middle days, you will still get zero counts - secondly the chart viz will create a timeline based on _time (whether there is data in the results table or not)

To solve this, firstly, you need to use bin and chart, and secondly you need to create a string field for the time

| bin _time span=1d 
| chart <your aggregate function> by _time LiftState
| eval time=strftime(_time, "%F")
| fields time *
| fields - _time

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

You have two issues here - firstly timechart fills in the blanks so even if there isn't any data for the middle days, you will still get zero counts - secondly the chart viz will create a timeline based on _time (whether there is data in the results table or not)

To solve this, firstly, you need to use bin and chart, and secondly you need to create a string field for the time

| bin _time span=1d 
| chart <your aggregate function> by _time LiftState
| eval time=strftime(_time, "%F")
| fields time *
| fields - _time

uagraw01
Builder

@ITWhisperer You are a genius.

richgalloway
SplunkTrust
SplunkTrust

Change the time range of the search to start in July 2023.  That may be within the lift_activity_marco_1d macro.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...