Splunk Search

How do I fill values in a timechart for a non existing event?

New Member

How do I fill values in a timechart for a non existing event? Suppose that the event is received at 5:00AM. Then, I would want to fill data of this 5:00AM to the timechart before 5:00AM? filldown is working to fill after 5:00AM, but not before 5:00AM.

source="something_source" topic="something_topic" earliest = "-1d" client="cpu1305" 
| timechart span=1m latest(msg) as Valuess
| filldown 
| fillnull value=latest(msg) Valuess
0 Karma
1 Solution

Champion

Something like this ?

 | timechart span=5m latest(action) as Valuess
 | filldown 
 |eventstats first(Valuess) as v | fillnull value=0 Valuess | eval Valuess=if(Valuess=0,v,Valuess) | fields - v

View solution in original post

0 Karma

Champion

Something like this ?

 | timechart span=5m latest(action) as Valuess
 | filldown 
 |eventstats first(Valuess) as v | fillnull value=0 Valuess | eval Valuess=if(Valuess=0,v,Valuess) | fields - v

View solution in original post

0 Karma

New Member

Hi! Thanks for the answer. Only one problem is that the values that are being filled before 5:00 AM is the latest value, but i need to fill it with the first received event, not the last received event.
i tried using 'first' in-place of 'last', but it doesn't work

0 Karma

New Member

no worries, i just found a solution. just moved the eventstats before fillnull and replaced 'last' with 'first'.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!