Splunk Search

Timechart glich with column VALUE

gorosco
Engager

Got a cenario where timechart returned me a column named 'VALUE' where I don't have a value=VALUE in my logs as part of my by clause

index=xpto
| rename field as NormalizedField
| stats count by NormalizedField
| join type=inner NormalizedField
      [ inputlookup table.csv] `coment("This table has 150000 rows with 1 column to make a filter on NormalizedField")`
|  timechart sum(count) as count span=60m by NormalizedField usenull=f useother=f limit=10 partial=f

The results where something like this:

_time | 3.4 | 3.5 | 3.8 | 3.8.2 | 3.9.0 | 3.9.1 | VALUE

My Problem is why this "VALUE" column is there if my NormalizedField don't ever have this result?

If I just do another stats instead of timechart I don't see this "VALUE" as a row for my NormalizedField.
Any toughts?

0 Karma

maityayan1996
Path Finder

In the top 10 value there is a field value like " "(NULL) for that one it is creating field call VALUE. You can modify your query like this way. You will get the output as expected. Please find the below image for your reference.

index=xpto
| rename field as NormalizedField
| stats count by NormalizedField
| join type=inner NormalizedField
[ inputlookup table.csv] coment("This table has 150000 rows with 1 column to make a filter on NormalizedField") | where isnotnull(NormalizedField)
| timechart sum(count) as count span=60m by NormalizedField usenull=f useother=f limit=10 partial=f

alt text

0 Karma

gorosco
Engager

I want precicely remove the VALUE column and I've made some filters do remove values where len(NormalizedField) < 2, just in case I had a field value like " " and I still got the problem.
As I know how many outputcolumns I should have I have narrow down the limit to that number to hide the column VALUE

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...