How to use chart command to show results for only days with values?

[mchristian]

So I'm trying to chart blocked traffic(IPs) over 7 days... the purpose to help locate beaconing traffic (this has worked at a previous job but im taking it a step further by only wanting to see days with values.... example:

I would want to see results that only show, All days with values... Query works just see alot of days with 0 data

Here's my query:

index="pan_logs" sourcetype="pan:traffic" dest_zone="Public" src="10.11.16*" action=blocked
| chart count(dest) by dest date_wday

[somesoni2]

Give this a try

index="pan_logs" sourcetype="pan:traffic" dest_zone="Public" src="10.11.16*" action=blocked
| chart count(dest) by dest date_wday
| eval do_not_show=0
| foreach M* T* W* F* S* [| eval do_not_show= do_not_show+if('<<FIELD>>'==0,1,0)] | where do_not_show=0 | fields - do_not_show

[mchristian]

Im still receiving 0 under days

[somesoni2]

Try this (accounting for case difference for field name)

index="pan_logs" sourcetype="pan:traffic" dest_zone="Public" src="10.11.16*" action=blocked
| chart count(dest) by dest date_wday
| eval do_not_show=0
| foreach M* m* T* t* W* w*  F* f* S* s* [| eval do_not_show= do_not_show+if('<<FIELD>>'==0,1,0)] | where do_not_show=0 | fields - do_not_show

[mchristian]

I received the same results... I may just try a different approach, i just feel like it shouldnt be this difficult

[ITWhisperer]

| untable dest date_wday count
| eventstats min(count) as minimum by dest
| where minimum>0
| xyseries dest date_wday count

[mchristian]

that didnt produce any results

[ITWhisperer]

| makeresults
| eval _raw="Dest IP,Monday,Tuesday,Wed,Thurs,Friday
1.1.1.1,5,3,0,0,0
2.2.2.2,3,3,3,3,3"
| multikv forceheader=1
| table Dest_IP Monday Tuesday Wed Thurs Friday
| untable Dest_IP date_wday count
| eventstats min(count) as minimum by Dest_IP
| where minimum>0
| xyseries Dest_IP date_wday count

[ITWhisperer]

| foreach *
  [| eval <<FIELD>>=if(<<FIELD>>=0,null(),<<FIELD>>)]

[mchristian]

That didnt work, pretty much gave the same results, instead of 0 its giving a blank or NULL.

[ITWhisperer]

Is that not what you wanted?

[mchristian]

No i would only want to see results that have values for all days, like example 2.2.2.2