Splunk Search

How can I include zero/empty count buckets in tables/charts?

Glenn
Builder

I am trying to create a histogram/distribution graph of deal durations, for comparison between where the user is accessing a website from.

This search works more or less OK:

"search that returns reults with deal durations in field totalTime" | chart count(_raw) as "Num Deals" by totalTime span=100

totalTime is returned as an integer 0-3000, meaning ideally I would have 30 buckets. My problem is that some locations are very slow, and there are no durations below 800. The chart command does not create any rows for durations lower than 800 (ie. 0-100, 100-200, 200-300 etc up to 700-800 are all missing). This makes direct comparisons between graphs difficult, as they do not show the same scale.

Is there any way to force Splunk to create empty buckets (starting from zero) for charting as per my requirement?

Splunk version 4.1.5.

Cheers,

Glenn

Tags (4)
0 Karma

ytamura
Path Finder

I'm assuming you are bucketing in terms of totalTime. What worked for me is the following search structure:

your search | chart count(totalTime) as "Num Deals" over totalTime span=100

Addendum: There's a function called makecontinuous that is supposed to do this, but I believe it actually just adds one to the bucket, which is somewhat misleading to a wider audience: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Makecontinuous

ytamura
Path Finder

Strange, tried again on a simple search and it works for me. I'm on 4.2 by the way. In fact, I did something like your search and I'm still getting 0 buckets displayed.

The only way I'm not getting any 0 buckets is if I do:
search | bucket X span=100 | chart count by X

Perhaps this is a difference between Splunk versions...

0 Karma

Glenn
Builder

Hi, I don't think this works. It gives me the same kind of picture as before - empty buckets before the first one (ie. 0-100, 100-200 if first result is in 200-300 bucket) are not created or charted.

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...