Splunk Search

Timechart filldown

perrinj2
Path Finder

 

I have a dashboard search which ends with a timechart like this

 

| eval VUser=if(isnotnull(Stop_time),0,VUser)

| timechart count(VUser) by Protocol

 

The event with the VUser field is only present for one time interval of the timechart series so I want do the equivalent of a filldown until Stop_time is not null and then reset the VUser count.

Filldown only works when there are nulls. In the above example when there are no values for VUser timechart generates a zero value rather than a null which is why filldown is no good.

 

What else can I do in this case?

 

 

Labels (1)
0 Karma

perrinj2
Path Finder

Good idea but this only works if I remove the "by Protocol" split which I need

The stats tab shows a series of columns with Protocol values as headings. How can I refer to these fields to try the eval command to change zero to null?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try "fudging" it by setting the zero values to nulls so filldown works.

| eval VUser=if(isnotnull(Stop_time),0,VUser)
| timechart count(VUser) as Count by Protocol
| eval Count=if(Count==0, NULL, Count)
| filldown Count

 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...