How to Graph white space before and after my data in a stats graph

[robertlynch2020]

Hi

I am trying to graph white spaces before and after my data.

The issue is that the data is a subset of the timerange, picked in the timepicker, and I am looking to graph the white spaces. Below, we can see that the start times are all different. Ideally, I want the start time to be the same, even if there are white spaces 11:32 - that is when the timepicker is set.

| mstats latest("mx.grid.task.count") as waiting WHERE "index"="murex_metrics" AND "mx.env"="PDTAlias.fr.murex.com:15720" AND service.name="DMS" AND service.namespace="MXGENERIC.SERVICE" AND endpoint.name IN (*) AND task.state IN (waiting) span=auto BY task.state, endpoint.name 
| rename endpoint.name as EndPoint 
| fields - task.state 
| appendcols 
    [| mstats latest("mx.grid.task.count") as completed WHERE "index"="murex_metrics" AND "mx.env"="PDTAlias.fr.murex.com:15720" AND service.name="DMS" AND service.namespace="MXGENERIC.SERVICE" AND endpoint.name IN (*) AND task.state IN (completed) span=auto BY task.state, endpoint.name 
    | rename endpoint.name as EndPoint 
    | fields - task.state ] 
| appendcols 
    [| mstats latest("mx.grid.task.count") as processing WHERE "index"="murex_metrics" AND "mx.env"="PDTAlias.fr.murex.com:15720" AND service.name="DMS" AND service.namespace="MXGENERIC.SERVICE" AND endpoint.name IN (*) AND task.state IN (processing) span=auto BY task.state, endpoint.name 
    | rename endpoint.name as EndPoint 
    | fields - task.state] 
| fields _time EndPoint waiting completed processing 
| stats max(completed) as Completed max(waiting) as Waiting max(processing) as Processing by _time EndPoint

I hope there is a tag that I can set to receive this.

Option 2.

I am running mstats. I was wondering if I can get it to return data for the time picker as no value, even if there are no metrics at that point.

We can see from the image below that the data started at 11:37 - but I am looking for 11:32. I would be looking for 5 minutes of Empty data.

However, I would like 0 to return, so when I graph it, they are on the correct y-axis. 

Any help would be brilliant

[bowesmana]

Why don't you use timechart rather than stats by _time. Timechart will give you the time range on the chart as defined by the time picker and then you can set gaps to be 0 in the chart.

[ITWhisperer]

timechart only has three dimensions, time, group and value, whereas four are required, time, state (waiting, processing, complete), EndPoint and value. While using timechart does give the timepicker boundaries, you still have to potentially introduce zero values for each EndPoint for each metric. It is probably simpler to just add entries with the stats command as I have shown.

[bowesmana · Accepted solution]

I think I must be missing something. This example generates a bunch of data for a few EndPoints along the lines of the OP data and if this is a trellis visualisation, the trellis takes care of the consistent X axis

| makeresults count=40

``` Generate some random data for 4 EndPoints ```
| eval EndPoint=mvindex(split("687131,687132,687133,687135",","), random() % 4)
| streamstats c by EndPoint
| eval _time=_time-c * 60
| sort _time EndPoint
| fillnull waiting completed processing value=5
| foreach waiting completed processing [ eval factor_<<FIELD>>=(random() % 3 - 1) * (random() % 3 - 1) ]
| streamstats window=1 current=f global=f avg(eval(min(max(waiting + factor_waiting, 0), 10))) as waiting avg(eval(min(max(completed + factor_completed, 0), 10))) as completed avg(eval(min(max(processing + factor_processing, 0), 10))) as processing by EndPoint
| fields _time EndPoint waiting completed processing

``` Timechart span1m with a 15 minute time picker ```
| timechart span=1m max(*) as * by EndPoint
```| stats max(*) as * by _time EndPoint```

timechart sets the X-axis consistently and you can decide what you want to do with how gaps are rendered with the timechart options

[robertlynch2020]

Hi

Thanks for this - this worked very well.

Cheers for the help

[ITWhisperer]

You are right, I was working with not missing the original final stats command. Replacing it works better!

[ITWhisperer]

Try something like this

| stats max(waiting) as Waiting max(completed) as Completed max(processing) as Processing by _time EndPoint
``` After your current search ```
| appendpipe
    [
    ``` Create an event for time picker start time ```
    | addinfo
    | stats min(info_min_time) as _time values(eval(0)) as Waiting by EndPoint
    | eval Completed=Waiting, Processing=Waiting
    ]
| stats sum(Waiting) as Waiting sum(Completed) as Completed sum(Processing) as Processing by _time EndPoint