Splunk Search

How to show only fields over 0?

vtsguerrero
Contributor

I have a query like this:
index=main Product=$product$ | time chart count by Quantity
But I need it to return only values > 0
What should I change here?
Thanks in advance!

1 Solution

strive
Influencer
index=main Product=$product$ | timechart count by Quantity | where count > 0

Updated

The search wont work when the timechart output is like this

_time Quantity1  Quantity2 Quantity3
T1     100        0         120
T2      0         1          1

If you just need quantities where count is greater than zero., then use stats

index=main Product=$product$ | stats count by Quantity | where count > 0

If you want to show timechart and not to show dips when value is zero then do this

index=main Product=$product$ | timechart cont=f count by Quantity

View solution in original post

strive
Influencer
index=main Product=$product$ | timechart count by Quantity | where count > 0

Updated

The search wont work when the timechart output is like this

_time Quantity1  Quantity2 Quantity3
T1     100        0         120
T2      0         1          1

If you just need quantities where count is greater than zero., then use stats

index=main Product=$product$ | stats count by Quantity | where count > 0

If you want to show timechart and not to show dips when value is zero then do this

index=main Product=$product$ | timechart cont=f count by Quantity

flacunsia
Engager

cont=f did the trick with timechart... thanks!

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

You use Splunk every day, come and help shape what's next.  Save Your Seat: Product-Focused Sessions at ...

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

Watch Now Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas     Do you ever feel ...