How to Display the time when logs are not ingested?

[Karthikeyan]

Hi Experts,

I'm new to splunk. I have created a dashboard to which logs are ingested every min and shows how many logs were ingested, as percentage i.e, on hourly basis it calculates the value as total. ingested logs/60. 

However, in the drill-down part, I would like to show the actual timing when the logs were not ingested. Let me know if there is a mechanism to achieve this.

Regards, Karthikeyan

[richgalloway]

Finding something that is not there is not Splunk's strong suit, but you may be able to accomplish what you desire by searching for the logs and listing the times when nothing was reported.  Fortunately, the timechart command will zero-fill time spans with no data.  Try something like this:

<<your search for logs>>
| timechart span=1m count
| where count=0