SPL search: How to showcase graph only with values?

[uagraw01]

Hello Splunkers!!

As pe the attached screenshot I want to hide values from sep 2022 to july 2023, because those period have a null values. So I want to showcase graph only with values.

[ITWhisperer · Accepted solution]

You have two issues here - firstly timechart fills in the blanks so even if there isn't any data for the middle days, you will still get zero counts - secondly the chart viz will create a timeline based on _time (whether there is data in the results table or not)

To solve this, firstly, you need to use bin and chart, and secondly you need to create a string field for the time

| bin _time span=1d 
| chart <your aggregate function> by _time LiftState
| eval time=strftime(_time, "%F")
| fields time *
| fields - _time

[uagraw01]

@ITWhisperer You are a genius.

[richgalloway]

Change the time range of the search to start in July 2023.  That may be within the lift_activity_marco_1d macro.