Reporting

How to fill missing values in a time range?

prithvi
Loves-to-Learn Lots

Is it possible to populate the intermediate missing data along the "Target" column in a continuous fashion over the period of time based on the start and end values

_time Total Target
2020-08-01   600
2020-09-15 1000  
2020-09-16 1250  
2020-09-17 1500  
2020-09-18 1750  
2020-09-19 2000  
2020-09-20 2250  
2020-09-21 2750  
2020-09-22 3250  
2020-10-05   5500

 

Tags (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| timechart span=1d ...
| fillnull value=0 Target Total

Timechart will give you continuous time bins, fillnull will allow you to set the value you want in a field if it is not present

prithvi
Loves-to-Learn Lots

But this only allows us to fill a constant value rite ? .... Whereas what I want to fill is with dynamic progressive values starting from the given input (here it's 600) 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults
| eval _raw="_time,Total,Target
2020-08-01,,600
2020-09-15,1000
2020-09-16,1250
2020-09-17,1500
2020-09-18,1750
2020-09-19,2000
2020-09-20,2250
2020-09-21,2750
2020-09-22,3250
2020-10-05,,5500"
| multikv forceheader=1
| eval _time=strptime(time,"%Y-%m-%d")
| table _time Total Target




| eventstats min(Target) as Min max(Target) as Max min(_time) as Start max(_time) as End
| eval days=floor((_time-Start)/(60*60*24))
| eventstats max(days) as period
| eval Target=Min+((Max-Min)*days/period)
| table _time Total Target

yoho
Contributor

use streamstats

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...