Splunk Search
Highlighted

How to convert a chart back to its original format?

New Member

I have the following SPL:

some search | table _time, col1, col2 | timechart span=2m useother=f values(col2) as col2 by col1 | fillnull value=0 

This creates a separate column for each value in col1. I now want to convert this data back into the original format i.e. a table in the format |_time|col1|col2|. I'm basically using the time chart command to fill in null values for every timestamp that had no value associated with it in the original data.

Is there any way I can do this ? I guess a better way would be to not use a time chart, but I'm not sure how. Not using a time chart give me the advantage of working with all the values of col1 (rather than only 10 as in the case of time chart)

0 Karma
Highlighted

Re: How to convert a chart back to its original format?

SplunkTrust
SplunkTrust

Since you want to fillnull for period you don't have data, timechart makes sense. You can overcome that 10 value limit by passing limit=50 or limi=100 to your timechart command. All you need after that is untable command. Try something like this

some search | table _time, col1, col2 | timechart span=2m useother=f values(col2) as col2 by col1 limit=50  | fillnull value=0
| untable _time col1 col2

View solution in original post

Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.