Splunk Search

How can I write a search that returns _time in 1-second intervals even when _time stamp doesn't match a value?

patilsh
Explorer

Hello Guys,

I have a column _time

Ex Values (Suppose the search has 4 events here):
2017-08-11 12:06:51
2017-08-11 12:06:54
2017-08-11 12:06:56
2017-08-11 12:06:58

Now my intention is I want _time to increment by one second, that even though there is not row with 2017-08-11 12:06:52, I want to add a row with all other columns to be 0,

So my new data should look like
2017-08-11 12:06:51
2017-08-11 12:06:52
2017-08-11 12:06:53
2017-08-11 12:06:54
2017-08-11 12:06:55
2017-08-11 12:06:56
2017-08-11 12:06:57
2017-08-11 12:06:58
So all the appended time which was not there should have the other column entries of search as 0. The new search should have 8 events now.

Can someone please help me with this, as I am not able to understand how to do it.

Regards
Shailendra Patil

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

You don't explain exactly what your search is, but you can probably get most of what you need to use by reading the following answers entry:

https://answers.splunk.com/answers/103432/how-to-replace-all-null-values-between-two-dates-min-and-m...

And here is the fillnull documentation:

https://docs.splunk.com/Documentation/SplunkCloud/6.6.0/SearchReference/Fillnull

0 Karma

lfedak_splunk
Splunk Employee
Splunk Employee

Hey @patilsh, This might help? https://answers.splunk.com/answers/10147/how-to-show-events-per-second-in-timechart-regardless-of-sp... I'm just a community moderator, so I'll keep an eye on the post and try new tags if no experts see it this weekend.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...