Reporting

How to fill missing values in a time range?

prithvi
Loves-to-Learn Lots

Is it possible to populate the intermediate missing data along the "Target" column in a continuous fashion over the period of time based on the start and end values

_time Total Target
2020-08-01   600
2020-09-15 1000  
2020-09-16 1250  
2020-09-17 1500  
2020-09-18 1750  
2020-09-19 2000  
2020-09-20 2250  
2020-09-21 2750  
2020-09-22 3250  
2020-10-05   5500

 

Tags (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| timechart span=1d ...
| fillnull value=0 Target Total

Timechart will give you continuous time bins, fillnull will allow you to set the value you want in a field if it is not present

prithvi
Loves-to-Learn Lots

But this only allows us to fill a constant value rite ? .... Whereas what I want to fill is with dynamic progressive values starting from the given input (here it's 600) 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults
| eval _raw="_time,Total,Target
2020-08-01,,600
2020-09-15,1000
2020-09-16,1250
2020-09-17,1500
2020-09-18,1750
2020-09-19,2000
2020-09-20,2250
2020-09-21,2750
2020-09-22,3250
2020-10-05,,5500"
| multikv forceheader=1
| eval _time=strptime(time,"%Y-%m-%d")
| table _time Total Target




| eventstats min(Target) as Min max(Target) as Max min(_time) as Start max(_time) as End
| eval days=floor((_time-Start)/(60*60*24))
| eventstats max(days) as period
| eval Target=Min+((Max-Min)*days/period)
| table _time Total Target

yoho
Contributor

use streamstats

0 Karma
Get Updates on the Splunk Community!

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...