Splunk Search

Maniupulating _time to remove 0 values from line chart

ericwindmill
Observer

I have a line chart in which I'm trying to monitor response time for a certain network call. I want to see the average response time, over time, by platform in a line chart.

Input data looks something like this:

network call #response time (ms)platform

1

200web
2250android
3300web
 140ios

 

and my current query looks like this:

 

index=myindex
| search mysearch
| spath response_time 
| spath input=request_payload output=platform path=client_properties.platform
| streamstats avg(response_time) as platform_response_time by platform time_window=10m
| chart first(platform_response_time) over _time by platform

 

 

This is getting my pretty close, but theres something about it that isn't "right" :

Screen Shot 2020-12-08 at 10.21.53 AM.png

What can I do to make the line's... better? I don't even know how to phrase this, but there shouldn't be 0 values. The lines shouldn't be jumping up and backdown to 0 at every tick. They should be more "straight". The problem, I think, is that I'm creating a point for each interval of time, and there isn't a request for every platform at every interval. 

Is there a way to group time intervals together in a longer period of time? i.e. there will only be a plot point for the average repsonse time each 5 minute interval? If there are truly 0 requests in 5m from a platform, that should be reflected, but it isn't likely and wouldn't happen so often.

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Use the timechart command and adjust the span until the zeros disappear.

index=myindex
| search mysearch
| spath response_time 
| spath input=request_payload output=platform path=client_properties.platform
| streamstats avg(response_time) as platform_response_time by platform time_window=10m
| timechart span=10m first(platform_response_time) by platform
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...