Splunk Search

Can we set different charting.nullValueMode for different chart in same graph

disha
Contributor

sourcetype="agent"
| spath path="EID" output=EventID
| search EventID=3
| spath path="SID" output=SID
|search SID="aaa-bbb"
| spath path="MU" output=mu
| eval mu=(mu/1024)|eval mu=round(mu,2)
| timechart first(mu) as "Memory Usage(MB)"|appendcols [search sourcetype="agent"
| spath path="EID" output=EventID
| search EventID=3
| spath path="SID" output=SID
|search SID="aaa-bbb" |spath path="DBG" output=Debug |eval n=25|timechart first(n) by Debug]

  1. I want for first timechart null values "connect" and for second one I need nullvalues "gap" or I need column chart for second timechart.
    I am trying line
    column
    connect
    OR
    line
    connect
    gap
    Nothing is working. Please help.

  2. Also I need to filter results where Debug!="{}"
    Any Suggestion Please?This is urgent.

Tags (1)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Concerning number one, set the chart to omit null values and compute your own connect for the other chart like this:

...  | streamstats count(f) as temp | streamstats count by temp | eventstats max(count) as max by temp | streamstats last(f) as last | reverse | streamstats last(f) as next | reverse | eval f = if(isnull(f),last+((next-last)/max)*(count-1),f) | fields - temp count max last next

To keep things looking nice, call your first(mu) as f at first, and later rename it - else you'd have the human-readable field all over the query.

Concerning number two, something like this?

... | where Debug!="{}"
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...