Hi Everyone, I'm working on a Splunk dashboard visualisation using a line chart, and I span the data for every 1week.But the line is not consistent if there is no data and I see dots scattered here and there. Is there a way to optimise this view. Attached is the screenshot. Thanks
index = "abc" Environment = $environment$ ProcessName=*$task$* LogType = "*" TaskName =* |bucket span=1w _time
|stats count(eval(LogMessage = "errorneously")) as Failed_Count, count(eval(LogMessage = "execution")) as Success_Count ,count(eval(LogMessage = "execution2")) as Success_Count1 by _time
|eval tot_count= Failed_Count + Success_Count + Success_Count1|eval scount=Success_Count + Success_Count1
| eval succ_per=round((scount/tot_count)*100,0)
|timechart span=1w avg(succ_per)
Set the format to zeroes
Hi
you could try makecontinuous and fillnull to stretch and fill those with some defaults.
r. Ismo