Splunk Search

How do I remove gaps in charts?

ADRIANODL
Explorer

Hi splunkers,

I was able to plot a graph that, whilst it shows all the info I need, it also contains massive gaps that make it less appealing.
Is it possible to eliminate those gaps? I'm not concerned about keeping the timeframe consistent.

MY search is as follows:

> index=crypto CurrencyB="CND" OR
> CurrencyS="CND"  | timechart
> sum(eval(if(CurrencyB="CND",Buy,Sell
> *-1))) as Total,  sum(eval(if(CurrencyB="CND",round(Sell/Buy,8),null)))
> as UnitPrice  span=d cont=FALSE |
> streamstats sum(Total) as Gtotal

Cheers

0 Karma

ADRIANODL
Explorer

this is what I'm looking for... sorry for the crappy chart but it gives you an idea 🙂
alt text

0 Karma

Vijeta
Influencer

Did you try using cont=TRUE?

0 Karma

ADRIANODL
Explorer

I did, it fills the gaps with bars, which is not what I want. Thanks though Vijeta!

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

Hi @ADRIANODL,
Ideally your query should work fine and as expected as you have mentioned cont=false with timechart, but if you are using old version of Splunk then please check Splunk doc of timechart (http://docs.splunk.com/Documentation/Splunk/5.0.6/SearchReference/Timechart) with Splunk version are you using. If not work try another approach below with stats function, if you are sure you want your data month wise (as show in the attached screenshot of question) then following query may help.

index=crypto CurrencyB="CND" OR CurrencyS="CND" 
| eval month=date_month." ".date_year
| stats sum(eval(if(CurrencyB="CND",Buy,Sell*-1))) as Total, sum(eval(if(CurrencyB="CND",round(Sell/Buy,8),null))) as UnitPrice by month
| streamstats sum(Total) as Gtotal

Try above query!!

0 Karma

ADRIANODL
Explorer

Hi Vatsal,
No luck, it groups things by month. 😞

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

Hi ADRIANODL,
I think in my case it is working just by writing cont=false, nothing else is required. Can you tell me which Splunk version are you working on?

0 Karma

ADRIANODL
Explorer

Hi Vatsal,
Actually, the data shown refers to days, not months. So at specific days of the year, certain events happened; I just want to show those, without the gaps. I'll try your query and let you know.

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...