Splunk Search

How to ignore days with no data in timechart?

tonahoyos
Explorer

Hello,

I want to be able to ignore days where data was not collected. I am using the following search:

index="x"
| timechart span=1d count(Number)

What command can I use to ignore these non value added days?

Tags (1)
0 Karma
1 Solution

FrankVl
Ultra Champion

Timechart generates a continuous timerange. If you just want the count on days where there are some events, just do the following:

index="x"
| bin _time span=1d
| stats count(Number) by _time

Or try the following, by setting cont=false for the timechart command:

index="x"
| timechart span=1d cont=false count(Number)

View solution in original post

niketn
Legend

Try adding cont=f parameter

index="x"
| timechart span=1d count(Number) cont=f
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

FrankVl
Ultra Champion

Timechart generates a continuous timerange. If you just want the count on days where there are some events, just do the following:

index="x"
| bin _time span=1d
| stats count(Number) by _time

Or try the following, by setting cont=false for the timechart command:

index="x"
| timechart span=1d cont=false count(Number)

niketn
Legend

@FrankVl, you documented both... I thought I would just add the timechart one :winking_face:

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...