Reporting

How to fill missing values in a time range?

prithvi
Loves-to-Learn Lots

Is it possible to populate the intermediate missing data along the "Target" column in a continuous fashion over the period of time based on the start and end values

_time Total Target
2020-08-01   600
2020-09-15 1000  
2020-09-16 1250  
2020-09-17 1500  
2020-09-18 1750  
2020-09-19 2000  
2020-09-20 2250  
2020-09-21 2750  
2020-09-22 3250  
2020-10-05   5500

 

Labels (1)
Tags (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| timechart span=1d ...
| fillnull value=0 Target Total

Timechart will give you continuous time bins, fillnull will allow you to set the value you want in a field if it is not present

prithvi
Loves-to-Learn Lots

But this only allows us to fill a constant value rite ? .... Whereas what I want to fill is with dynamic progressive values starting from the given input (here it's 600) 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults
| eval _raw="_time,Total,Target
2020-08-01,,600
2020-09-15,1000
2020-09-16,1250
2020-09-17,1500
2020-09-18,1750
2020-09-19,2000
2020-09-20,2250
2020-09-21,2750
2020-09-22,3250
2020-10-05,,5500"
| multikv forceheader=1
| eval _time=strptime(time,"%Y-%m-%d")
| table _time Total Target




| eventstats min(Target) as Min max(Target) as Max min(_time) as Start max(_time) as End
| eval days=floor((_time-Start)/(60*60*24))
| eventstats max(days) as period
| eval Target=Min+((Max-Min)*days/period)
| table _time Total Target

yoho
Contributor

use streamstats

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...