Splunk Search

How do I fill values in a timechart for a non existing event?

avisriv
New Member

How do I fill values in a timechart for a non existing event? Suppose that the event is received at 5:00AM. Then, I would want to fill data of this 5:00AM to the timechart before 5:00AM? filldown is working to fill after 5:00AM, but not before 5:00AM.

source="something_source" topic="something_topic" earliest = "-1d" client="cpu1305" 
| timechart span=1m latest(msg) as Valuess
| filldown 
| fillnull value=latest(msg) Valuess
0 Karma
1 Solution

Sukisen1981
Champion

Something like this ?

 | timechart span=5m latest(action) as Valuess
 | filldown 
 |eventstats first(Valuess) as v | fillnull value=0 Valuess | eval Valuess=if(Valuess=0,v,Valuess) | fields - v

View solution in original post

0 Karma

Sukisen1981
Champion

Something like this ?

 | timechart span=5m latest(action) as Valuess
 | filldown 
 |eventstats first(Valuess) as v | fillnull value=0 Valuess | eval Valuess=if(Valuess=0,v,Valuess) | fields - v

View solution in original post

0 Karma

avisriv
New Member

Hi! Thanks for the answer. Only one problem is that the values that are being filled before 5:00 AM is the latest value, but i need to fill it with the first received event, not the last received event.
i tried using 'first' in-place of 'last', but it doesn't work

0 Karma

avisriv
New Member

no worries, i just found a solution. just moved the eventstats before fillnull and replaced 'last' with 'first'.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.