Splunk Search

How to ignore days with no data in timechart?

tonahoyos
Explorer

Hello,

I want to be able to ignore days where data was not collected. I am using the following search:

index="x"
| timechart span=1d count(Number)

What command can I use to ignore these non value added days?

Tags (1)
0 Karma
1 Solution

FrankVl
Ultra Champion

Timechart generates a continuous timerange. If you just want the count on days where there are some events, just do the following:

index="x"
| bin _time span=1d
| stats count(Number) by _time

Or try the following, by setting cont=false for the timechart command:

index="x"
| timechart span=1d cont=false count(Number)

View solution in original post

niketn
Legend

Try adding cont=f parameter

index="x"
| timechart span=1d count(Number) cont=f
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

FrankVl
Ultra Champion

Timechart generates a continuous timerange. If you just want the count on days where there are some events, just do the following:

index="x"
| bin _time span=1d
| stats count(Number) by _time

Or try the following, by setting cont=false for the timechart command:

index="x"
| timechart span=1d cont=false count(Number)

niketn
Legend

@FrankVl, you documented both... I thought I would just add the timechart one 😉

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.0.2 Availability: On cloud and On-premise!

A few months ago, we released Splunk Enterprise Security 8.0 for our cloud customers. Today, we are excited to ...

Logs to Metrics

Logs and Metrics Logs are generally unstructured text or structured events emitted by applications and written ...

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...