Splunk Search

How to get rid of blank space in my linechart result when using timechart command?

sureshmurgan
Path Finder

I am trying to read cpu usage from PC and trying to present it using timechart. It adds blank (the chart has gaps inbetween) when machine is offline and no data to populate during that time. How can I ignore those gaps and make it continuous.

When I use cont=false, it removes the _time values from x-axis and shows only the name _time. I need both values as well as I need to get of the gaps from the timechart.

Is there any option ?

Tags (1)
0 Karma
1 Solution

niketn
Legend

@sureshmurgan

1.If you need to treat gaps as 0
a) For display purpose only in chart you can use charting.chart.nullValueMode as suggested by @Sukisen1981 (by default is gap)

<option name="charting.chart.nullValueMode">zero</option>

b) If you want to use the value as 0 in timechart as well then you would need to use fillnull command after the timechart command.

2.If you need to connect the gaps same as previous value
a) For display purpose only in chart you can use charting.chart.nullValueMode as suggested by @Sukisen1981

<option name="charting.chart.nullValueMode">connect</option>

b) For cascading previous value in the timechart as well use filldown command.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

sureshmurgan
Path Finder

If I go with the default option gap, it shows some annoying square boxes in the line chart, making it look shabby.

Is there a way to remove those square boxes from the default gap representation of chart?

0 Karma

niketn
Legend

@sureshmurgan would it be possible for you to add a screenshot of what you have and explain with the same as to what you need?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

niketn
Legend

@sureshmurgan

1.If you need to treat gaps as 0
a) For display purpose only in chart you can use charting.chart.nullValueMode as suggested by @Sukisen1981 (by default is gap)

<option name="charting.chart.nullValueMode">zero</option>

b) If you want to use the value as 0 in timechart as well then you would need to use fillnull command after the timechart command.

2.If you need to connect the gaps same as previous value
a) For display purpose only in chart you can use charting.chart.nullValueMode as suggested by @Sukisen1981

<option name="charting.chart.nullValueMode">connect</option>

b) For cascading previous value in the timechart as well use filldown command.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

sureshmurgan
Path Finder

Thanks Niketnilay ! I have tried all those 3 options and I would stick with the default option gap.

If I go with the default option gap, it shows some annoying square boxes in the line chart, making it look shabby.

Is there a way to remove those square boxes from the default gap representation of chart?

0 Karma

Sukisen1981
Champion

use null values connect in the general options in timechart viz

sureshmurgan
Path Finder

Thanks Sukisen ! Connect option essentially makes it continuous from last data point to the next data point.

0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...