How do I fill values in a timechart for a non existing event? Suppose that the event is received at 5:00AM. Then, I would want to fill data of this 5:00AM to the timechart before 5:00AM? filldown
is working to fill after 5:00AM, but not before 5:00AM.
source="something_source" topic="something_topic" earliest = "-1d" client="cpu1305"
| timechart span=1m latest(msg) as Valuess
| filldown
| fillnull value=latest(msg) Valuess
Something like this ?
| timechart span=5m latest(action) as Valuess
| filldown
|eventstats first(Valuess) as v | fillnull value=0 Valuess | eval Valuess=if(Valuess=0,v,Valuess) | fields - v
Something like this ?
| timechart span=5m latest(action) as Valuess
| filldown
|eventstats first(Valuess) as v | fillnull value=0 Valuess | eval Valuess=if(Valuess=0,v,Valuess) | fields - v
Hi! Thanks for the answer. Only one problem is that the values that are being filled before 5:00 AM is the latest value, but i need to fill it with the first received event, not the last received event.
i tried using 'first' in-place of 'last', but it doesn't work
no worries, i just found a solution. just moved the eventstats before fillnull and replaced 'last' with 'first'.