Dashboards & Visualizations

Show black data in a chart when there is no data

robertlynch2020
Influencer

Hi 

I have the following data that gives me the below graph, however, if the data stops coming in I want to see "black steps" to the rights, to show the use there is no more data.

So ideally I want a time chart, as this will happen naturally do this, but not sure how to get this from the query that I have.

Another option is to keep time filling till now() and then put in a fill null for all the values to = 0.

robertlynch2020_0-1627482477319.png

robertlynch2020_1-1627482554882.png

 

| mstats max("mx.process.cpu.utilization") as cpuPerc max("mx.process.threads") as nbOfThreads max("mx.process.memory.usage") as memoryCons max("mx.process.file_descriptors") as nbOfOpenFiles avg("mx.process.up.time") as upTime avg("mx.process.creation.time") as creationTime WHERE "index"="metrics_test" AND mx.env=http://mx20267vm:15000 span=1000s BY pid 
| foreach * 
    [ eval <<FIELD>>=if(<<FIELD>> > .0000001, 1 ,0)]

 

 

Any help would be great thanks

Labels (2)
0 Karma
1 Solution

robertlynch2020
Influencer

Solved

 

| mstats max("mx.process.cpu.utilization") as cpuPerc max("mx.process.threads") as nbOfThreads max("mx.process.memory.usage") as memoryCons max("mx.process.file_descriptors") as nbOfOpenFiles avg("mx.process.up.time") as upTime avg("mx.process.creation.time") as creationTime WHERE "index"="metrics_test" AND mx.env=http://mx20267vm:15000 span=1m BY pid 
| foreach * 
    [ eval <<FIELD>>=if(<<FIELD>> > .0000001, 1 ,0)] 
| timechart max(cpuPerc) as  cpuPerc , max(nbOfThreads) as nbOfThreads | fillnull

View solution in original post

0 Karma

robertlynch2020
Influencer

Solved

 

| mstats max("mx.process.cpu.utilization") as cpuPerc max("mx.process.threads") as nbOfThreads max("mx.process.memory.usage") as memoryCons max("mx.process.file_descriptors") as nbOfOpenFiles avg("mx.process.up.time") as upTime avg("mx.process.creation.time") as creationTime WHERE "index"="metrics_test" AND mx.env=http://mx20267vm:15000 span=1m BY pid 
| foreach * 
    [ eval <<FIELD>>=if(<<FIELD>> > .0000001, 1 ,0)] 
| timechart max(cpuPerc) as  cpuPerc , max(nbOfThreads) as nbOfThreads | fillnull
0 Karma
Get Updates on the Splunk Community!

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Community Feedback

We Want to Hear from You! Share Your Feedback on the Splunk Community   The Splunk Community is built for you ...

Manual Instrumentation with Splunk Observability Cloud: Implementing the ...

In our observability journey so far, we've built comprehensive instrumentation for our Worms in Space ...