Splunk Search

Ignore null values

jackpal
Path Finder

I am using the nix agent to gather disk space.  I only collect "df" information once per day. I want to be able to present a statistics table that only shows the rows with values.  When I do the query below I get alot of empty rows.  I'd like to only show the rows with data.

index=os sourcetype=df host=hostname filesystem=*mapper*lim*
| eval LIM_PROD_DISK=case(
filesystem LIKE "%limproda1%", "limproda1",
filesystem LIKE "%limproda2%", "limproda2",
filesystem LIKE "%limprodwide0%", "limprodwide0",
filesystem LIKE "%limprodwide1%", "limprodwide1",
filesystem LIKE "%limprodwide2%", "limprodwide2",
filesystem LIKE "%limtoolsvol%", "limptoolsvol"
)
| bin _time span=1d
| timechart max(storage_used_percent) by LIM_PROD_DISK

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The timechart command has the cont option for that.  Try 

index=os sourcetype=df host=hostname filesystem=*mapper*lim*
| eval LIM_PROD_DISK=case(
filesystem LIKE "%limproda1%", "limproda1",
filesystem LIKE "%limproda2%", "limproda2",
filesystem LIKE "%limprodwide0%", "limprodwide0",
filesystem LIKE "%limprodwide1%", "limprodwide1",
filesystem LIKE "%limprodwide2%", "limprodwide2",
filesystem LIKE "%limtoolsvol%", "limptoolsvol"
)
| bin _time span=1d
| timechart cont=f max(storage_used_percent) by LIM_PROD_DISK

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The timechart command has the cont option for that.  Try 

index=os sourcetype=df host=hostname filesystem=*mapper*lim*
| eval LIM_PROD_DISK=case(
filesystem LIKE "%limproda1%", "limproda1",
filesystem LIKE "%limproda2%", "limproda2",
filesystem LIKE "%limprodwide0%", "limprodwide0",
filesystem LIKE "%limprodwide1%", "limprodwide1",
filesystem LIKE "%limprodwide2%", "limprodwide2",
filesystem LIKE "%limtoolsvol%", "limptoolsvol"
)
| bin _time span=1d
| timechart cont=f max(storage_used_percent) by LIM_PROD_DISK

 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...