Splunk Search

Timechart glich with column VALUE

gorosco
Engager

Got a cenario where timechart returned me a column named 'VALUE' where I don't have a value=VALUE in my logs as part of my by clause

index=xpto
| rename field as NormalizedField
| stats count by NormalizedField
| join type=inner NormalizedField
      [ inputlookup table.csv] `coment("This table has 150000 rows with 1 column to make a filter on NormalizedField")`
|  timechart sum(count) as count span=60m by NormalizedField usenull=f useother=f limit=10 partial=f

The results where something like this:

_time | 3.4 | 3.5 | 3.8 | 3.8.2 | 3.9.0 | 3.9.1 | VALUE

My Problem is why this "VALUE" column is there if my NormalizedField don't ever have this result?

If I just do another stats instead of timechart I don't see this "VALUE" as a row for my NormalizedField.
Any toughts?

0 Karma

maityayan1996
Path Finder

In the top 10 value there is a field value like " "(NULL) for that one it is creating field call VALUE. You can modify your query like this way. You will get the output as expected. Please find the below image for your reference.

index=xpto
| rename field as NormalizedField
| stats count by NormalizedField
| join type=inner NormalizedField
[ inputlookup table.csv] coment("This table has 150000 rows with 1 column to make a filter on NormalizedField") | where isnotnull(NormalizedField)
| timechart sum(count) as count span=60m by NormalizedField usenull=f useother=f limit=10 partial=f

alt text

0 Karma

gorosco
Engager

I want precicely remove the VALUE column and I've made some filters do remove values where len(NormalizedField) < 2, just in case I had a field value like " " and I still got the problem.
As I know how many outputcolumns I should have I have narrow down the limit to that number to hide the column VALUE

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...