Splunk Search

Can we set different charting.nullValueMode for different chart in same graph

disha
Contributor

sourcetype="agent"
| spath path="EID" output=EventID
| search EventID=3
| spath path="SID" output=SID
|search SID="aaa-bbb"
| spath path="MU" output=mu
| eval mu=(mu/1024)|eval mu=round(mu,2)
| timechart first(mu) as "Memory Usage(MB)"|appendcols [search sourcetype="agent"
| spath path="EID" output=EventID
| search EventID=3
| spath path="SID" output=SID
|search SID="aaa-bbb" |spath path="DBG" output=Debug |eval n=25|timechart first(n) by Debug]

  1. I want for first timechart null values "connect" and for second one I need nullvalues "gap" or I need column chart for second timechart.
    I am trying line
    column
    connect
    OR
    line
    connect
    gap
    Nothing is working. Please help.

  2. Also I need to filter results where Debug!="{}"
    Any Suggestion Please?This is urgent.

Tags (1)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Concerning number one, set the chart to omit null values and compute your own connect for the other chart like this:

...  | streamstats count(f) as temp | streamstats count by temp | eventstats max(count) as max by temp | streamstats last(f) as last | reverse | streamstats last(f) as next | reverse | eval f = if(isnull(f),last+((next-last)/max)*(count-1),f) | fields - temp count max last next

To keep things looking nice, call your first(mu) as f at first, and later rename it - else you'd have the human-readable field all over the query.

Concerning number two, something like this?

... | where Debug!="{}"
0 Karma
Get Updates on the Splunk Community!

Unlock Database Monitoring with Splunk Observability Cloud

  In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and ...

Purpose in Action: How Splunk Is Helping Power an Inclusive Future for All

At Cisco, purpose isn’t a tagline—it’s a commitment. Cisco’s FY25 Purpose Report outlines how the company is ...

[Upcoming Webinar] Demo Day: Transforming IT Operations with Splunk

Join us for a live Demo Day at the Cisco Store on January 21st 10:00am - 11:00am PST In the fast-paced world ...