Reporting

How to fill missing values in a time range?

prithvi
Loves-to-Learn Lots

Is it possible to populate the intermediate missing data along the "Target" column in a continuous fashion over the period of time based on the start and end values

_time Total Target
2020-08-01   600
2020-09-15 1000  
2020-09-16 1250  
2020-09-17 1500  
2020-09-18 1750  
2020-09-19 2000  
2020-09-20 2250  
2020-09-21 2750  
2020-09-22 3250  
2020-10-05   5500

 

Labels (1)
Tags (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| timechart span=1d ...
| fillnull value=0 Target Total

Timechart will give you continuous time bins, fillnull will allow you to set the value you want in a field if it is not present

prithvi
Loves-to-Learn Lots

But this only allows us to fill a constant value rite ? .... Whereas what I want to fill is with dynamic progressive values starting from the given input (here it's 600) 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults
| eval _raw="_time,Total,Target
2020-08-01,,600
2020-09-15,1000
2020-09-16,1250
2020-09-17,1500
2020-09-18,1750
2020-09-19,2000
2020-09-20,2250
2020-09-21,2750
2020-09-22,3250
2020-10-05,,5500"
| multikv forceheader=1
| eval _time=strptime(time,"%Y-%m-%d")
| table _time Total Target




| eventstats min(Target) as Min max(Target) as Max min(_time) as Start max(_time) as End
| eval days=floor((_time-Start)/(60*60*24))
| eventstats max(days) as period
| eval Target=Min+((Max-Min)*days/period)
| table _time Total Target

yoho
Contributor

use streamstats

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...