Reporting

How to fill missing values in a time range?

prithvi
Loves-to-Learn Lots

Is it possible to populate the intermediate missing data along the "Target" column in a continuous fashion over the period of time based on the start and end values

_time Total Target
2020-08-01   600
2020-09-15 1000  
2020-09-16 1250  
2020-09-17 1500  
2020-09-18 1750  
2020-09-19 2000  
2020-09-20 2250  
2020-09-21 2750  
2020-09-22 3250  
2020-10-05   5500

 

Tags (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| timechart span=1d ...
| fillnull value=0 Target Total

Timechart will give you continuous time bins, fillnull will allow you to set the value you want in a field if it is not present

prithvi
Loves-to-Learn Lots

But this only allows us to fill a constant value rite ? .... Whereas what I want to fill is with dynamic progressive values starting from the given input (here it's 600) 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults
| eval _raw="_time,Total,Target
2020-08-01,,600
2020-09-15,1000
2020-09-16,1250
2020-09-17,1500
2020-09-18,1750
2020-09-19,2000
2020-09-20,2250
2020-09-21,2750
2020-09-22,3250
2020-10-05,,5500"
| multikv forceheader=1
| eval _time=strptime(time,"%Y-%m-%d")
| table _time Total Target




| eventstats min(Target) as Min max(Target) as Max min(_time) as Start max(_time) as End
| eval days=floor((_time-Start)/(60*60*24))
| eventstats max(days) as period
| eval Target=Min+((Max-Min)*days/period)
| table _time Total Target

yoho
Contributor

use streamstats

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...