Splunk Search

List times inbetween events when using timechart

blhuynh
Explorer

Using timechart, I have a a table with a list of dates and a value. However, the dates are non-consecutive (although ordered). I want to add in the missing dates inbetween the current values and backfill the values for the extra dates.

For example, my data looks like this currently:

_time   values(A)
2014-05-04  73
2014-05-18  74
2014-06-01  75
2014-06-15  76

I would like for this to be transformed into the following:

_time   values(A)
2014-05-04  73
2014-05-05  73
2014-05-06  73
....
2014-05-18  74
2014-05-19  74
2014-05-20  74
...
0 Karma
1 Solution

woodcock
Esteemed Legend

You need to do a couple of things. As @somesoni2 pointed out, you need to create the missing events, but then you also need to fill in the values for those events because the fields will not exist if you do not. Try this:

 your current search with timechart | makecontinuous _time span=1d | eval VA="values(A)" | streamstats current=t max(VA) AS "values(A)" | fields - VA

You may need to adjust slightly depending on how your events are actually aligned but the core is correct.

View solution in original post

woodcock
Esteemed Legend

You need to do a couple of things. As @somesoni2 pointed out, you need to create the missing events, but then you also need to fill in the values for those events because the fields will not exist if you do not. Try this:

 your current search with timechart | makecontinuous _time span=1d | eval VA="values(A)" | streamstats current=t max(VA) AS "values(A)" | fields - VA

You may need to adjust slightly depending on how your events are actually aligned but the core is correct.

blhuynh
Explorer

Worked for me! Thanks for elaborating more.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try something like thsi

your current search with timechart | makecontinuous

More information on makecontinous command http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Makecontinuous

blhuynh
Explorer

Thanks for the help! Worked along with the streamstats suggestion below.

0 Karma

lguinn2
Legend

Usually, timechart will produce all the intervening dates with empty values. Can you show the exact commands that you used?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...