sourcetype="agent"
| spath path="EID" output=EventID
| search EventID=3
| spath path="SID" output=SID
|search SID="aaa-bbb"
| spath path="MU" output=mu
| eval mu=(mu/1024)|eval mu=round(mu,2)
| timechart first(mu) as "Memory Usage(MB)"|appendcols [search sourcetype="agent"
| spath path="EID" output=EventID
| search EventID=3
| spath path="SID" output=SID
|search SID="aaa-bbb" |spath path="DBG" output=Debug |eval n=25|timechart first(n) by Debug]
I want for first timechart null values "connect" and for second one I need nullvalues "gap" or I need column chart for second timechart.
I am trying
Also I need to filter results where Debug!="{}"
Any Suggestion Please?This is urgent.
Concerning number one, set the chart to omit null values and compute your own connect for the other chart like this:
... | streamstats count(f) as temp | streamstats count by temp | eventstats max(count) as max by temp | streamstats last(f) as last | reverse | streamstats last(f) as next | reverse | eval f = if(isnull(f),last+((next-last)/max)*(count-1),f) | fields - temp count max last next
To keep things looking nice, call your first(mu) as f at first, and later rename it - else you'd have the human-readable field all over the query.
Concerning number two, something like this?
... | where Debug!="{}"