Splunk Search

How do you stop displaying a timechart line when value is 0?

dfofie
New Member

I'm trying to display a timechart based on count by a type.

But, for a certain type, the value will always be 0 for a certain time.

is it possible to tell Splunk to simply stop displaying the line from a certain datetime ? or when the count is 0 ?

The screenshot below shows the different lines and the part I marked is supposed to be hidden.

alt text

0 Karma

Vijeta
Influencer

How about adding , where count>0 in your query

0 Karma

dfofie
New Member

that doesn't work for me. When I enter where count>0 nothing appends. Not sure if this where clause is being taken in account.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...