Splunk Search

How do you stop displaying a timechart line when value is 0?

dfofie
New Member

I'm trying to display a timechart based on count by a type.

But, for a certain type, the value will always be 0 for a certain time.

is it possible to tell Splunk to simply stop displaying the line from a certain datetime ? or when the count is 0 ?

The screenshot below shows the different lines and the part I marked is supposed to be hidden.

alt text

0 Karma

Vijeta
Influencer

How about adding , where count>0 in your query

0 Karma

dfofie
New Member

that doesn't work for me. When I enter where count>0 nothing appends. Not sure if this where clause is being taken in account.

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...