Splunk Search

Get columns that have non-zero value columns over time (using timechart)

sahil237888
Path Finder

Hi Team,
Can anyone help me on this -
I want to Get columns that have non-zero values over time (using timechart).

_time Column1 Column2 Column3 Column4 Column5 Column N
2/14/2020 2:11 0 0 0 0 0 0
2/14/2020 2:12 0 0 0 0 0 0
2/14/2020 2:13 1 0 0 0 0 0
2/14/2020 2:14 0 0 1 0 0 0
2/14/2020 2:15 0 0 0 5 0 0
2/14/2020 2:16 0 0 0 0 0 0
2/14/2020 2:17 0 0 0 0 0 0
2/14/2020 2:18 0 0 0 0 0 0

The query I am using (But I am not able to remove zero value columns )

index=servers sourcetype=server_list Columns ="*"
| timechart span=1m count as Total by Columns
| where Columns > 0

0 Karma

to4kawa
Ultra Champion

e.g.

index=_internal max_size_kb > 0
 | timechart span=1m count as Total by max_size_kb
 | foreach * [ eval check=max(check,'<<FIELD>>') ]
 | where check > 0

recommend:

index=servers sourcetype=server_list Columns > 0
| timechart span=1m count as Total by Columns
| foreach * [ eval check=max(check,'<<FIELD>>') ]
| where check > 0
0 Karma

codebuilder
Influencer

You just need to modify your search:

index=servers sourcetype=server_list Columns > 0
| timechart span=1m count as Total by Columns

You can test using the _internal index with the following (e.g.):

index=_internal max_size_kb > 0
| timechart span=1m count as Total by max_size_kb
----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...