Turn on suggestions

Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.

Showing results for

Splunk Search

Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.

Showing results for

- Community
- :
- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How to remove results which are 0 in my timechart ...

- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page

Highlighted

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

khilawar4

Engager

01-23-2017
12:14 PM

I am trying to find out the index usage per day and getting total usage at the end as well. but if i want to remove all the column from search result which are 0. how to do that?

```
index=_internal metrics kb group="per_index_thruput" NOT series=_* NOT series="*summary*" host=*appblx*
| eval totalMB = kb /1024
| eval totalGB = round(totalMB /1024, 2)
| timechart useother=f limit=0 span=1d sum(totalGB) as total by series |addtotals fieldname=TotaldailyUsageinGB
```

1 Solution

Highlighted
##

Depends on what you mean. Are you trying to remove series whose values are zero, or remove dates which have no activity, or what?

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: How to remove results which are 0 in my timechart search?

DalJeanis

SplunkTrust

01-23-2017
01:03 PM

Highlighted
##

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: How to remove results which are 0 in my timechart search?

khilawar4

Engager

01-23-2017
01:07 PM

I am trying to remove output columns (series) whose values are 0

Highlighted

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

somesoni2

SplunkTrust

01-23-2017
01:07 PM

Give this a try

```
index=_internal metrics kb group="per_index_thruput" NOT series=_* NOT series="*summary*" host=*appblx*
| eval totalGB = round(kb /1024/1024,2)
| bucket span=1d _time
| chart sum(totalGB) as total by _time series limit=0 |addtotals fieldname=TotaldailyUsageinGB
```

Highlighted
##

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: How to remove results which are 0 in my timechart search?

khilawar4

Engager

01-23-2017
01:14 PM

Still same.

Highlighted
##

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: How to remove results which are 0 in my timechart search?

khilawar4

Engager

01-23-2017
01:20 PM

below query worked for me , added "where" condition.

index=*internal metrics kb group="per*index*thruput" NOT series=** NOT series="*summary*" host=*appblx*

| eval totalGB = round(kb/1024/1024,2) | where totalGB > 0

| bucket span=1d _time

| chart sum(totalGB) as total by _time series limit=0 |addtotals fieldname=TotaldailyUsageinGB

Highlighted
##

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: How to remove results which are 0 in my timechart search?

dbcase

Motivator

01-23-2017
01:22 PM

How about this?

```
index=_internal metrics kb group="per_index_thruput" NOT series=_* NOT series="*summary*" host=*appblx*
| eval totalMB = kb /1024
| eval totalGB = round(totalMB /1024, 2)
| timechart useother=f limit=0 span=1d sum(totalGB) as total by series |where total>0|addtotals fieldname=TotaldailyUsageinGB
```

Highlighted
##

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: How to remove results which are 0 in my timechart search?

khilawar4

Engager

01-23-2017
01:45 PM

thx for the comment .

your query doesn't give result somehow but below query works.

below query worked for me , added "where" condition.

index=internal metrics kb group="per*index*thruput" NOT series=* NOT series="summary" host=appblx

| eval totalGB = round(kb/1024/1024,2) | where totalGB > 0

| bucket span=1d _time

| chart sum(totalGB) as total by _time series limit=0 |addtotals fieldname=TotaldailyUsageinGB

Highlighted
##

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: How to remove results which are 0 in my timechart search?

rjthibod

Champion

01-23-2017
01:31 PM

Try this

```
| index=_internal metrics kb group="per_index_thruput" NOT series=_* NOT series="*summary*" host=*appblx*
| bin _time span=1d
| chart limit=0 eval(round(sum(kb)/1024/1024,2)) by _time series
| foreach * [eval "<<FIELD>>" = if (isnull('<<FIELD>>') OR '<<FIELD>>' = 0, null(), '<<FIELD>>')]
| addtotals fieldname=TotaldailyUsageinGB
```