Splunk Search

Can we set different charting.nullValueMode for different chart in same graph

disha
Contributor

sourcetype="agent"
| spath path="EID" output=EventID
| search EventID=3
| spath path="SID" output=SID
|search SID="aaa-bbb"
| spath path="MU" output=mu
| eval mu=(mu/1024)|eval mu=round(mu,2)
| timechart first(mu) as "Memory Usage(MB)"|appendcols [search sourcetype="agent"
| spath path="EID" output=EventID
| search EventID=3
| spath path="SID" output=SID
|search SID="aaa-bbb" |spath path="DBG" output=Debug |eval n=25|timechart first(n) by Debug]

  1. I want for first timechart null values "connect" and for second one I need nullvalues "gap" or I need column chart for second timechart.
    I am trying line
    column
    connect
    OR
    line
    connect
    gap
    Nothing is working. Please help.

  2. Also I need to filter results where Debug!="{}"
    Any Suggestion Please?This is urgent.

Tags (1)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Concerning number one, set the chart to omit null values and compute your own connect for the other chart like this:

...  | streamstats count(f) as temp | streamstats count by temp | eventstats max(count) as max by temp | streamstats last(f) as last | reverse | streamstats last(f) as next | reverse | eval f = if(isnull(f),last+((next-last)/max)*(count-1),f) | fields - temp count max last next

To keep things looking nice, call your first(mu) as f at first, and later rename it - else you'd have the human-readable field all over the query.

Concerning number two, something like this?

... | where Debug!="{}"
0 Karma
Get Updates on the Splunk Community!

Infographic provides the TL;DR for the 2024 Splunk Career Impact Report

We’ve been buzzing with excitement about the recent validation of Splunk Education! The 2024 Splunk Career ...

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...