Splunk Search

How to make Search Visualization where count=0?

ToddClayton
Engager

Complete novice here, but I was able to get my search result thanks to others who have had questions.

Currently I'm successfully running a search that shows me by hour where count = 0

 

<<search>>

| timechart span=1h count

| where count=0

 

I get my date/hour in statistics showing me each hour that's getting a count of 0. 

But I'd like to visualize it better. Hit Visualize and it shows me a nice chart with a flatlined Y axis. Of course, because everything is 0.

I can't quite wrap my head around showing this data in a more visually appealing format. Every day there are a couple of "0 count" hours. Maybe something that shows each day and the number of "0 count" hours? 

Thanks in advance.

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try adding | timechart span=1d count to the end of the query.  That should give the number of hours with zero counts each day.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Try adding | timechart span=1d count to the end of the query.  That should give the number of hours with zero counts each day.

---
If this reply helps you, Karma would be appreciated.

ToddClayton
Engager

That helps greatly!

Thank you very much @richgalloway!

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

AI is one of the biggest topics in the market today, and for security teams, its value goes far beyond the ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Detection Engineering Office Hours: Real-World Troubleshooting & Q&A

[REGISTER HERE] This thread is for the Community Office Hours session on Detection Engineering Office Hours: ...