Splunk Search

How to ignore days with no data in timechart?

tonahoyos
Explorer

Hello,

I want to be able to ignore days where data was not collected. I am using the following search:

index="x"
| timechart span=1d count(Number)

What command can I use to ignore these non value added days?

Tags (1)
0 Karma
1 Solution

FrankVl
Ultra Champion

Timechart generates a continuous timerange. If you just want the count on days where there are some events, just do the following:

index="x"
| bin _time span=1d
| stats count(Number) by _time

Or try the following, by setting cont=false for the timechart command:

index="x"
| timechart span=1d cont=false count(Number)

View solution in original post

niketn
Legend

Try adding cont=f parameter

index="x"
| timechart span=1d count(Number) cont=f
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

FrankVl
Ultra Champion

Timechart generates a continuous timerange. If you just want the count on days where there are some events, just do the following:

index="x"
| bin _time span=1d
| stats count(Number) by _time

Or try the following, by setting cont=false for the timechart command:

index="x"
| timechart span=1d cont=false count(Number)

niketn
Legend

@FrankVl, you documented both... I thought I would just add the timechart one 😉

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...