Splunk Search

Chart including no results

jacqu3sy
Path Finder

I'm trying to create a chart showing activity from May through until now, knowing that the activity ceased some months ago. I want the chart to continue  showing a flat line of zero from the time the activity stopped, rather than just stopping back in August.

How would I tweak the following query to include the ceased traffic?

earliest=05/01/2020:00:00:01 latest=now
index=nix sourcetype="nix" src_user=JohnD host=server1 
| bin _time span=1w
| stats count by _time, host

Thanks.

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

The timechart command will generate the empty results for you

earliest=05/01/2020:00:00:01 latest=now
index=nix sourcetype="nix" src_user=JohnD host=server1 
| timechart span=1w count by host

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The timechart command will generate the empty results for you

earliest=05/01/2020:00:00:01 latest=now
index=nix sourcetype="nix" src_user=JohnD host=server1 
| timechart span=1w count by host
0 Karma

jacqu3sy
Path Finder

Simple as that! great, thanks. 

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...