Splunk Search

Timechart drops empty results - causes trouble with predict

Olli1919
Path Finder

Hi,

I am doing a prediction with a "timechart count" as base search, which works fine:

index=logins username | timechart span=1d count | predict count

But when the base search has leading "zero event count" days, timechart cuts off these days. This happens whether fillnull is used or not. This now causes a problem with predict, as predict requires a minimum of two data points: Predict gives its first results for the third day, but it should also report the change on day one and two.

Is there a way to make timechart keep the empty leading results?

Thanks,
Oliver

Tags (3)
1 Solution

emechler_splunk
Splunk Employee
Splunk Employee

Use fillnull (from http://answers.splunk.com/answers/106774😞

index=logins username | fillnull value=NoValue | timechart span=1d count | predict count

View solution in original post

emechler_splunk
Splunk Employee
Splunk Employee

Use fillnull (from http://answers.splunk.com/answers/106774😞

index=logins username | fillnull value=NoValue | timechart span=1d count | predict count

Olli1919
Path Finder

This works, thank you - I thought I had tried it 🙂

0 Karma

Olli1919
Path Finder

I found this, but isn't there an easier solution? The Splunk GUI also displays the right results just before they get chopped off in the page refresh an instant later 😉

http://answers.splunk.com/answers/118496/fill-in-0-for-timechart-with-missing-values

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...