Splunk Search

How to make Search Visualization where count=0?

ToddClayton
Engager

Complete novice here, but I was able to get my search result thanks to others who have had questions.

Currently I'm successfully running a search that shows me by hour where count = 0

 

<<search>>

| timechart span=1h count

| where count=0

 

I get my date/hour in statistics showing me each hour that's getting a count of 0. 

But I'd like to visualize it better. Hit Visualize and it shows me a nice chart with a flatlined Y axis. Of course, because everything is 0.

I can't quite wrap my head around showing this data in a more visually appealing format. Every day there are a couple of "0 count" hours. Maybe something that shows each day and the number of "0 count" hours? 

Thanks in advance.

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try adding | timechart span=1d count to the end of the query.  That should give the number of hours with zero counts each day.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Try adding | timechart span=1d count to the end of the query.  That should give the number of hours with zero counts each day.

---
If this reply helps you, Karma would be appreciated.

ToddClayton
Engager

That helps greatly!

Thank you very much @richgalloway!

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Rounding off the Splunk Dashboard Contest

What does a contest-winning Splunk dashboard look like? In this case, it isn't in a browser tab at all. It ...

A Four Part Event Series: AI + Observability: AI Agents, LLMs, Apps, & Infrastructure

AI &#43; Observability: AI Agents, LLMs, Apps, & Infrastructure The rapid evolution of artificial intelligence ...