Dashboards & Visualizations

Show black data in a chart when there is no data

robertlynch2020
Influencer

Hi 

I have the following data that gives me the below graph, however, if the data stops coming in I want to see "black steps" to the rights, to show the use there is no more data.

So ideally I want a time chart, as this will happen naturally do this, but not sure how to get this from the query that I have.

Another option is to keep time filling till now() and then put in a fill null for all the values to = 0.

robertlynch2020_0-1627482477319.png

robertlynch2020_1-1627482554882.png

 

| mstats max("mx.process.cpu.utilization") as cpuPerc max("mx.process.threads") as nbOfThreads max("mx.process.memory.usage") as memoryCons max("mx.process.file_descriptors") as nbOfOpenFiles avg("mx.process.up.time") as upTime avg("mx.process.creation.time") as creationTime WHERE "index"="metrics_test" AND mx.env=http://mx20267vm:15000 span=1000s BY pid 
| foreach * 
    [ eval <<FIELD>>=if(<<FIELD>> > .0000001, 1 ,0)]

 

 

Any help would be great thanks

Labels (2)
0 Karma
1 Solution

robertlynch2020
Influencer

Solved

 

| mstats max("mx.process.cpu.utilization") as cpuPerc max("mx.process.threads") as nbOfThreads max("mx.process.memory.usage") as memoryCons max("mx.process.file_descriptors") as nbOfOpenFiles avg("mx.process.up.time") as upTime avg("mx.process.creation.time") as creationTime WHERE "index"="metrics_test" AND mx.env=http://mx20267vm:15000 span=1m BY pid 
| foreach * 
    [ eval <<FIELD>>=if(<<FIELD>> > .0000001, 1 ,0)] 
| timechart max(cpuPerc) as  cpuPerc , max(nbOfThreads) as nbOfThreads | fillnull

View solution in original post

0 Karma

robertlynch2020
Influencer

Solved

 

| mstats max("mx.process.cpu.utilization") as cpuPerc max("mx.process.threads") as nbOfThreads max("mx.process.memory.usage") as memoryCons max("mx.process.file_descriptors") as nbOfOpenFiles avg("mx.process.up.time") as upTime avg("mx.process.creation.time") as creationTime WHERE "index"="metrics_test" AND mx.env=http://mx20267vm:15000 span=1m BY pid 
| foreach * 
    [ eval <<FIELD>>=if(<<FIELD>> > .0000001, 1 ,0)] 
| timechart max(cpuPerc) as  cpuPerc , max(nbOfThreads) as nbOfThreads | fillnull
0 Karma
Get Updates on the Splunk Community!

Earn a $35 Gift Card for Answering our Splunk Admins & App Developer Survey

Survey for Splunk Admins and App Developers is open now! | Earn a $35 gift card!      Hello there,  Splunk ...

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...