Splunk Search

How to show the line when its value is NULL with chart command / chartコマンドで行の値が0の時表示する方法

mint_choco
Explorer

Hi, I try to display the number of events per day from multiple indexes.

I wrote the below SPL, but when all index values are null for a specific date, the line itself is not displayed.

複数のindexから、nullには0を代入し、1日ごとのイベント件数を表示させたいです。

chartコマンドを使いイベント件数を表示、特定indexの値がnullの場合はisnullで0を代入できたのですが、特定の日にちだけ全てのindexの値がnullの時、その日の行自体が表示されません。

index IN (index1, index2, index3, index4)
| bin span=1d _time
| chart count _time over index
| eval index4=if(isnull(index4), 0, index4)

 

How to display a line of 4/2 by substituting 0 like the below table, when all indexes value of 4/2 are null?

下記の表のように4/2の値がなくとも、0を代入して4/2の行を表示させる方法はないでしょうか。

 index1index2index3index4
4/1123450
4/20000
4/3167340
Labels (3)
0 Karma
1 Solution

livehybrid
SplunkTrust
SplunkTrust

Hi @mint_choco 

Before the fillnull you culd try using "makecontinuous"

Something like this (adjust accordingly):

| makecontinuous _time span=1d

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| addtotals fieldname=_total
| where _total > 0
0 Karma

livehybrid
SplunkTrust
SplunkTrust

Hi @mint_choco 

I believe you can either use filldown or fillnull here. 
After your chart command you could use the following, note that you *might not* have to specify all of the fields here, but if you do not specify them then it will only fillnull fields which already exist, therefore if no values for index4 are found then index4 would not appear at all in your chart.

 | fillnull index1 index2 index3 index4 value=0

 If you prefer to use the previous value in its place then use filldown:

| filldown 

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

0 Karma

mint_choco
Explorer

Hi, @livehybrid 

Thanks your reply. Unfortunately, it didn't work.

I can fill the col index4 by using fillnull, instead of  "| eval index4=if(isnull(index4), 0, index4)".
But, I got the table like below. The line for 4/2 still missing.

_timeindex1index2index3index4
4/1123450
4/3167340
4/4156700

 

There is no logs on April 2nd, so there is no line for 4/2, I guess.
Is there no way to make line for April 2nd? Maybe should I try without chart command?

0 Karma

livehybrid
SplunkTrust
SplunkTrust

Hi @mint_choco 

Before the fillnull you culd try using "makecontinuous"

Something like this (adjust accordingly):

| makecontinuous _time span=1d

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

mint_choco
Explorer

@livehybrid 

"makecontinuous" - This is exactly what I need!

I didn't know there is such useful command.
My question is solved.

Thank you!

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...