Splunk Search

Chart including no results

jacqu3sy
Path Finder

I'm trying to create a chart showing activity from May through until now, knowing that the activity ceased some months ago. I want the chart to continue  showing a flat line of zero from the time the activity stopped, rather than just stopping back in August.

How would I tweak the following query to include the ceased traffic?

earliest=05/01/2020:00:00:01 latest=now
index=nix sourcetype="nix" src_user=JohnD host=server1 
| bin _time span=1w
| stats count by _time, host

Thanks.

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

The timechart command will generate the empty results for you

earliest=05/01/2020:00:00:01 latest=now
index=nix sourcetype="nix" src_user=JohnD host=server1 
| timechart span=1w count by host

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The timechart command will generate the empty results for you

earliest=05/01/2020:00:00:01 latest=now
index=nix sourcetype="nix" src_user=JohnD host=server1 
| timechart span=1w count by host

View solution in original post

0 Karma

jacqu3sy
Path Finder

Simple as that! great, thanks. 

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!