Splunk Search

Ignore rows without any values in timechart

rnvrnv
Engager

hi all,
I am trying to create a timechart of number of, for example errors in certain days. In result table i get list of all days. that is fine. what i would like to do now is only show row (day) where some data exist. Will appreciate your help.

regards,
rnv

Tags (3)
0 Karma
1 Solution

niketn
Legend

@rnvrnv another option would be to use timechart with cont=f. Following is a run anywhere search based on Splunk's _internal index

index=_internal sourcetype=splunkd log_level!=INFO
| timechart span=1d count as ERRORS cont=f
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@rnvrnv another option would be to use timechart with cont=f. Following is a run anywhere search based on Splunk's _internal index

index=_internal sourcetype=splunkd log_level!=INFO
| timechart span=1d count as ERRORS cont=f
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

HiroshiSatoh
Champion

Try this!

(your search)
 | timechart span=1d count by XXX
↓
(your search)
 | bin _time span=1d
 | chart count over _time by XXX
0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...