If I only have transaction data from 8AM to 6PM, how do I display a timechart from 00 to 24 hours?

[jkponnuri]

I have data (transactions data) which shows 8 AM to 6 PM, but I need to show a report from 00 hrs to 24 hrs. I tried timechart span=1hr and fillnull value=NULL, but it's filling only null values in between 8 AM to 6 PM. I need timechart for the entire 24 hrs.

[somesoni2 · Accepted solution]

This should do the task for you

source=ABC field1="xyz" | timechart span=1s count as req_per_second | timechart span=1hr max(req_per_second) as max  | appendpipe [| gentimes start=-1 | addinfo | eval temp=info_min_time." ".info_max_time | table temp| makemv temp | mvexpand temp  | rename temp as _time ]  | timechart span=1h max(max) as max | makecontinuous | fillnull value=0

[jkponnuri]

EXCELLENT!!! I got results as expected. Thanks a ton....

[jkponnuri]

Also. Can you help, If I need for one hour timechart with complete 60 mins info to display?

[jkponnuri]

Thanks for the answer, I am not sure where is the wrong... I am receiving time from 1970. 🙂 is there any change we can do to display only 24 hr data. Thanks again.

[somesoni2]

What time range did you select while running the query? I guess you're running for All Time causing the info_min_time to go back to 1970. I suppose you should select some finite time range like Yesterday, last 7 days etc.

[jnussbaum_splun]

So if I'm understanding you correctly - you have data between 8am-6pm, but want to show a timechart from 00-24hr, where data that doesn't exist gets a null value as a "placeholder value".

try: | timechart span=1h count | appendpipe [|stats count |addinfo | eval temp=info_min_time."##".info_max_time | makemv temp delim="##" | mvexpand temp | eval count=0 | eval _time=temp | table _time count] | timechart span=1h sum(count) as count | fillnull

This will give those hours that have no data a 0 value.

[jkponnuri]

Hi. Thanks for the answer but it didn't show 24 hrs. Actually I am calculating transaction per second in an hour. And showing in a timechart with only peak transactions in that hour for entire 24 hours.

Here I tried...
Source=ABC field1="xyz" | timechart span=1s count as req_per_second | timechart span=1hr max(req_per_second) as max | fillnull value=0 | table _time max