Add a Line into a TimeChart

[quatral]

Hi,

I'm trying to develop a TIMECHART that represent a Download/Upload bandtwidth from bandwidthd log. The TIMECHART should have total bandwidth for each months of the year and a line representing the limit per month.

I've try to make an EVAL that set a value to that limit, heres the code:

host="x" sourcetype="bandwidthd" | EVAL val_total_giga_bytes_limit=80 | EVAL val_total_giga_bytes_sent=cus_bndw_total_bytes_sent/1024/1024/1024 | TIMECHART SPAN=1month sum(val_total_giga_bytes_sent) AS "Giga-Octet envoyé" avg(val_total_giga_bytes_limit) AS "Limite"

The problem is, when I've got NULL value (on my test only September as events log), the "Limit" doesn't show properly.

Is there any options somewhere that could be done? I've tried in dashboard with the Null Value manage as zero but I just want the SUM to be at zero but the AVG still set at 80.

Sorry for my poor english skills.

Drew

[kristian_kolb · Accepted solution]

Have you tried fillnull (if your 'bad' events look like a= b= c= etc)

host="x" sourcetype="bandwidthd" 
| eval GB_limit=80 
| fillnull cus_bndw_total_bytes_sent
| eval GB_sent = cus_bndw_total_bytes_sent/1024/1024/1024 
| timechart span=1month sum(GB_sent) AS "Giga-Octet envoyé" avg(GB_limit) AS "Limite"

or if the 'bad' events look like a=NULL b=NULL etc, then use

replace NULL with 0 in cus_bndw_total_bytes_sent

instead of fillnull

http://docs.splunk.com/Documentation/Splunk/4.3.4/SearchReference/Replace
http://docs.splunk.com/Documentation/Splunk/4.3.4/SearchReference/Fillnull

Hope this helps,

Kristian

[quatral]

• replace all the GB_limit = 1 by 80

[quatral]

Hi Kristian, the problem is not the cus_bndw_total_bytes_sent but the GB_limit (in your exemple). I'm making a timechart for a year but I only have data for two months. I want GB_limit to be at 80 for all the 12 months even if there is no data loged.

host="x" sourcetype="y"
| EVAL GB_limit = 1
| FILLNULL GB_limit = 1
| EVAL GB_sent = cus_bndw_total_bytes_sent/1024/1024/1024
| FILLNULL GB_sent
| TIMECHART SPAN=1month SUM(GB_sent) AS "Giga-Octet envoyé" AVG(GB_limit) AS "Limite"

but I got a "Error in 'fillnull' command: Invalid argument: '='".