Splunk Search

How to hide time without values in timechart

alvaromoraes
Path Finder

Hello comunity,

I need help to hide a value unavailable in a timechart. I searched for some functions, but I have no sucess trying.

Please, see the image below:

alt text

I don't want the time column "13:00" appearing in timechart, 'cause i don't have results yet (my database query get results with an interval of 15 minutes). You know anything to hide it until results are avaiable?

My search:

sourcetype="backlog_baonline" | timechart span=1h max(TOTAL) by ACTIVITY limit=100 | rename _time AS Time | eval Time=strftime(Time, "%H:%M")

Time range: -4h to now

I tried usenull=f useother=f, but it didn't work for my purpose.

Thank you in advance!

Tags (3)
0 Karma

alvaromoraes
Path Finder

Yes, I tried to modify the time range like you said, but it didn't work. The column without any results always appear in the chart.

Thanks for the answer.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Something like this?

...  | timechart count | reverse | accum count as total_count | reverse | where total_count > 0 | fields - total_count
0 Karma

alvaromoraes
Path Finder

I tried your suggestion in my source, same problem. I hate this empty column! haha

Thanks for the answer.

0 Karma

chris
Motivator

Have you tried playing with the end time of your search? sourcetype="backlog_baonline" earliest=-4h latest=-1h | timechart span=1h max(TOTAL) by ACTIVITY limit=100 | rename _time AS Time | eval Time=strftime(Time, "%H:%M")

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...