Ignore rows without any values in timechart

[rnvrnv]

hi all,
I am trying to create a timechart of number of, for example errors in certain days. In result table i get list of all days. that is fine. what i would like to do now is only show row (day) where some data exist. Will appreciate your help.

regards,
rnv

[niketn · Accepted solution]

@rnvrnv another option would be to use timechart with cont=f. Following is a run anywhere search based on Splunk's _internal index

index=_internal sourcetype=splunkd log_level!=INFO
| timechart span=1d count as ERRORS cont=f

[HiroshiSatoh]

Try this!

(your search)
 | timechart span=1d count by XXX
↓
(your search)
 | bin _time span=1d
 | chart count over _time by XXX