Splunk Search

If I only have transaction data from 8AM to 6PM, how do I display a timechart from 00 to 24 hours?

Explorer

I have data (transactions data) which shows 8 AM to 6 PM, but I need to show a report from 00 hrs to 24 hrs. I tried timechart span=1hr and fillnull value=NULL, but it's filling only null values in between 8 AM to 6 PM. I need timechart for the entire 24 hrs.

Tags (2)
0 Karma
1 Solution

Revered Legend

This should do the task for you

source=ABC field1="xyz" | timechart span=1s count as req_per_second | timechart span=1hr max(req_per_second) as max  | appendpipe [| gentimes start=-1 | addinfo | eval temp=info_min_time." ".info_max_time | table temp| makemv temp | mvexpand temp  | rename temp as _time ]  | timechart span=1h max(max) as max | makecontinuous | fillnull value=0

View solution in original post

Revered Legend

This should do the task for you

source=ABC field1="xyz" | timechart span=1s count as req_per_second | timechart span=1hr max(req_per_second) as max  | appendpipe [| gentimes start=-1 | addinfo | eval temp=info_min_time." ".info_max_time | table temp| makemv temp | mvexpand temp  | rename temp as _time ]  | timechart span=1h max(max) as max | makecontinuous | fillnull value=0

View solution in original post

Explorer

EXCELLENT!!! I got results as expected. Thanks a ton....

0 Karma

Explorer

Also. Can you help, If I need for one hour timechart with complete 60 mins info to display?

0 Karma

Explorer

Thanks for the answer, I am not sure where is the wrong... I am receiving time from 1970. 🙂 is there any change we can do to display only 24 hr data. Thanks again.

0 Karma

Revered Legend

What time range did you select while running the query? I guess you're running for All Time causing the info_min_time to go back to 1970. I suppose you should select some finite time range like Yesterday, last 7 days etc.

Splunk Employee
Splunk Employee

So if I'm understanding you correctly - you have data between 8am-6pm, but want to show a timechart from 00-24hr, where data that doesn't exist gets a null value as a "placeholder value".

try: | timechart span=1h count | appendpipe [|stats count |addinfo | eval temp=info_min_time."##".info_max_time | makemv temp delim="##" | mvexpand temp | eval count=0 | eval _time=temp | table _time count] | timechart span=1h sum(count) as count | fillnull

This will give those hours that have no data a 0 value.

0 Karma

Explorer

Hi. Thanks for the answer but it didn't show 24 hrs. Actually I am calculating transaction per second in an hour. And showing in a timechart with only peak transactions in that hour for entire 24 hours.

Here I tried...
Source=ABC field1="xyz" | timechart span=1s count as req_per_second | timechart span=1hr max(req_per_second) as max | fillnull value=0 | table _time max

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!