Splunk Search

How to delete data points with null values by host to produce a continuous linear graph?

serenalin
New Member

Hello,

I want to delete the time point if there is the one or more host max(time)>avg(time)+5 at that point in time. Now, just let the point become null if max(time)>avg(time)+5. How to delete the time point if there are >=1 null? I hope I can have the continuous linear graph.
alt text
alt text

0 Karma
1 Solution

gokadroid
Motivator

If its really about connecting the dots so that your line chart is not broken then why don't you try the Format Visualization option which can give you options to make your graph continuous on finding nulls. Reason I suggest so is if you delete a particular time point based on a single null value for one line, then all the other lines will end up deleting the value for that point, which might not be desirable. Achieve the connecting the Null dots as follows:

Select line chart/graph in your Visualization and then Click on Pen Tool (Format) > General > Null Values > > (Gaps| Zero | Connect)

Where Gaps is your current scenario
Zero will plot 0 for null values
Connect will just connect past the null

alt textalt text

View solution in original post

gokadroid
Motivator

If its really about connecting the dots so that your line chart is not broken then why don't you try the Format Visualization option which can give you options to make your graph continuous on finding nulls. Reason I suggest so is if you delete a particular time point based on a single null value for one line, then all the other lines will end up deleting the value for that point, which might not be desirable. Achieve the connecting the Null dots as follows:

Select line chart/graph in your Visualization and then Click on Pen Tool (Format) > General > Null Values > > (Gaps| Zero | Connect)

Where Gaps is your current scenario
Zero will plot 0 for null values
Connect will just connect past the null

alt textalt text

Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...