Dashboards & Visualizations

Show black data in a chart when there is no data

robertlynch2020
Influencer

Hi 

I have the following data that gives me the below graph, however, if the data stops coming in I want to see "black steps" to the rights, to show the use there is no more data.

So ideally I want a time chart, as this will happen naturally do this, but not sure how to get this from the query that I have.

Another option is to keep time filling till now() and then put in a fill null for all the values to = 0.

robertlynch2020_0-1627482477319.png

robertlynch2020_1-1627482554882.png

 

| mstats max("mx.process.cpu.utilization") as cpuPerc max("mx.process.threads") as nbOfThreads max("mx.process.memory.usage") as memoryCons max("mx.process.file_descriptors") as nbOfOpenFiles avg("mx.process.up.time") as upTime avg("mx.process.creation.time") as creationTime WHERE "index"="metrics_test" AND mx.env=http://mx20267vm:15000 span=1000s BY pid 
| foreach * 
    [ eval <<FIELD>>=if(<<FIELD>> > .0000001, 1 ,0)]

 

 

Any help would be great thanks

Labels (2)
0 Karma
1 Solution

robertlynch2020
Influencer

Solved

 

| mstats max("mx.process.cpu.utilization") as cpuPerc max("mx.process.threads") as nbOfThreads max("mx.process.memory.usage") as memoryCons max("mx.process.file_descriptors") as nbOfOpenFiles avg("mx.process.up.time") as upTime avg("mx.process.creation.time") as creationTime WHERE "index"="metrics_test" AND mx.env=http://mx20267vm:15000 span=1m BY pid 
| foreach * 
    [ eval <<FIELD>>=if(<<FIELD>> > .0000001, 1 ,0)] 
| timechart max(cpuPerc) as  cpuPerc , max(nbOfThreads) as nbOfThreads | fillnull

View solution in original post

0 Karma

robertlynch2020
Influencer

Solved

 

| mstats max("mx.process.cpu.utilization") as cpuPerc max("mx.process.threads") as nbOfThreads max("mx.process.memory.usage") as memoryCons max("mx.process.file_descriptors") as nbOfOpenFiles avg("mx.process.up.time") as upTime avg("mx.process.creation.time") as creationTime WHERE "index"="metrics_test" AND mx.env=http://mx20267vm:15000 span=1m BY pid 
| foreach * 
    [ eval <<FIELD>>=if(<<FIELD>> > .0000001, 1 ,0)] 
| timechart max(cpuPerc) as  cpuPerc , max(nbOfThreads) as nbOfThreads | fillnull
0 Karma
Get Updates on the Splunk Community!

.conf25 Registration is OPEN!

Ready. Set. Splunk! Your favorite Splunk user event is back and better than ever. Get ready for more technical ...

Detecting Cross-Channel Fraud with Splunk

This article is the final installment in our three-part series exploring fraud detection techniques using ...

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...