Splunk Search

How do you stop displaying a timechart line when value is 0?

dfofie
New Member

I'm trying to display a timechart based on count by a type.

But, for a certain type, the value will always be 0 for a certain time.

is it possible to tell Splunk to simply stop displaying the line from a certain datetime ? or when the count is 0 ?

The screenshot below shows the different lines and the part I marked is supposed to be hidden.

alt text

0 Karma

Vijeta
Influencer

How about adding , where count>0 in your query

0 Karma

dfofie
New Member

that doesn't work for me. When I enter where count>0 nothing appends. Not sure if this where clause is being taken in account.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...