Using timechart, I have a a table with a list of dates and a value. However, the dates are non-consecutive (although ordered). I want to add in the missing dates inbetween the current values and backfill the values for the extra dates.
For example, my data looks like this currently:
_time values(A)
2014-05-04 73
2014-05-18 74
2014-06-01 75
2014-06-15 76
I would like for this to be transformed into the following:
_time values(A)
2014-05-04 73
2014-05-05 73
2014-05-06 73
....
2014-05-18 74
2014-05-19 74
2014-05-20 74
...
You need to do a couple of things. As @somesoni2 pointed out, you need to create the missing events, but then you also need to fill in the values for those events because the fields will not exist if you do not. Try this:
your current search with timechart | makecontinuous _time span=1d | eval VA="values(A)" | streamstats current=t max(VA) AS "values(A)" | fields - VA
You may need to adjust slightly depending on how your events are actually aligned but the core is correct.
You need to do a couple of things. As @somesoni2 pointed out, you need to create the missing events, but then you also need to fill in the values for those events because the fields will not exist if you do not. Try this:
your current search with timechart | makecontinuous _time span=1d | eval VA="values(A)" | streamstats current=t max(VA) AS "values(A)" | fields - VA
You may need to adjust slightly depending on how your events are actually aligned but the core is correct.
Worked for me! Thanks for elaborating more.
Try something like thsi
your current search with timechart | makecontinuous
More information on makecontinous
command http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Makecontinuous
Thanks for the help! Worked along with the streamstats suggestion below.
Usually, timechart will produce all the intervening dates with empty values. Can you show the exact commands that you used?