Splunk Search

Limiting timechart span to only include values > 0

Path Finder

I have a search that is returning the value of a field called num_oracle_batch. I am using the following to get a per_minute count of the number of batches:

timechart span=1m per_minute(num_oracle_batch)

My question is, how can I limit the timechart to only show where the value of num_oracle_batch is an actual number. As it stands, if I choose today from the timepicker, my Y axis is the entire day even though I only had matching search results in only a few minutes in the 9 oclock hour.

So in short, can I dynamically set my timerange based on event results?

Tags (2)

Splunk Employee
Splunk Employee

You can add cont=f to the timechart options, making the chart not continuous. With that, your timechart becomes:

timechart span=1m per_minute(num_oracle_batch) cont=f

(From: http://www.splunk.com/base/Documentation/latest/SearchReference/Timechart#Arguments)

Let me know if that doesn't work.

Splunk Employee
Splunk Employee

My pleasure. I'd had the same question before, but had never looked up the answer. It's good to know!

0 Karma

Path Finder

Thats exactly what I was looking for. I have been struggling with sub-searches and where clauses to get what I was looking for.

THANKS!

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!