Splunk Search

How to get rid of blank space in my linechart result when using timechart command?

sureshmurgan
Path Finder

I am trying to read cpu usage from PC and trying to present it using timechart. It adds blank (the chart has gaps inbetween) when machine is offline and no data to populate during that time. How can I ignore those gaps and make it continuous.

When I use cont=false, it removes the _time values from x-axis and shows only the name _time. I need both values as well as I need to get of the gaps from the timechart.

Is there any option ?

Tags (1)
0 Karma
1 Solution

niketn
Legend

@sureshmurgan

1.If you need to treat gaps as 0
a) For display purpose only in chart you can use charting.chart.nullValueMode as suggested by @Sukisen1981 (by default is gap)

<option name="charting.chart.nullValueMode">zero</option>

b) If you want to use the value as 0 in timechart as well then you would need to use fillnull command after the timechart command.

2.If you need to connect the gaps same as previous value
a) For display purpose only in chart you can use charting.chart.nullValueMode as suggested by @Sukisen1981

<option name="charting.chart.nullValueMode">connect</option>

b) For cascading previous value in the timechart as well use filldown command.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

sureshmurgan
Path Finder

If I go with the default option gap, it shows some annoying square boxes in the line chart, making it look shabby.

Is there a way to remove those square boxes from the default gap representation of chart?

0 Karma

niketn
Legend

@sureshmurgan would it be possible for you to add a screenshot of what you have and explain with the same as to what you need?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

niketn
Legend

@sureshmurgan

1.If you need to treat gaps as 0
a) For display purpose only in chart you can use charting.chart.nullValueMode as suggested by @Sukisen1981 (by default is gap)

<option name="charting.chart.nullValueMode">zero</option>

b) If you want to use the value as 0 in timechart as well then you would need to use fillnull command after the timechart command.

2.If you need to connect the gaps same as previous value
a) For display purpose only in chart you can use charting.chart.nullValueMode as suggested by @Sukisen1981

<option name="charting.chart.nullValueMode">connect</option>

b) For cascading previous value in the timechart as well use filldown command.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

sureshmurgan
Path Finder

Thanks Niketnilay ! I have tried all those 3 options and I would stick with the default option gap.

If I go with the default option gap, it shows some annoying square boxes in the line chart, making it look shabby.

Is there a way to remove those square boxes from the default gap representation of chart?

0 Karma

Sukisen1981
Champion

use null values connect in the general options in timechart viz

sureshmurgan
Path Finder

Thanks Sukisen ! Connect option essentially makes it continuous from last data point to the next data point.

0 Karma
Get Updates on the Splunk Community!

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...