Splunk Search

How to write this complex search displayed with a transpose _time command?



I use a complex search with display results ordered by time in a table 

As you can see the time period is today between 7h and 19h



| appendcols 
    [ search `index` type=* earliest=@d+7h latest=@d+19h 
    | search web_domain=sharepoint.com 
    | search web_duration_ms > 7000 
    | stats count as PbPerf by sam _time 
    | timechart span=1h dc(sam) as "SHAREPOINT - Nb d'utilisateurs ayant un temps de réponse > 7 sec" 
| appendcols 
    [ search `index`  type=* earliest=@d+7h latest=@d+19h 
    | search web_domain=laposte.sharepoint.com 
    | timechart span=1h count as "SHAREPOINT - Nb d'erreurs" 
| where _time <now() 
| eval time=strftime(_time,"%H:%M") 
| sort time 
| fields - _time _span _origtime 
| transpose 0 header_field=time column_name=KPI 
| fillnull value=0 
| sort + KPI




The results are displayed like this


In the KPI field, I have 10 differents items

The problem I have is when I run the dashboard at 7h, I have just one or 2 items displayed without results in the span = 7h all the more that the column corresponding to 7h is not displayed!

Items start to be displayed when there is a result > 0 and in this case the column "7h" is well displayed

What I need is when I launch the dashboard at 7h and even if the time is less than 8h, I have all the items for the KPI column displayed and the column "7h" too with results=0 if there is no results or of course with results if there is results

could you help me on this complex need please?


Labels (1)
Tags (1)
0 Karma


Pearhaps I found a solution with appendpipe

can i use this solution?

| appendcols 
    [ search `index` earliest=@d+7h latest=@d+19h 
    | timechart span=1h count as "DOSSIER - Nb d'erreurs" 
    | appendpipe 
        [ stats count as _events 
        | where _events = 0 
        | eval "DOSSIER - Nb d'erreurs" = 0 ]
0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...