Splunk Search

Timechart to filter inactive buckets

muralianup
Communicator

I need help with time chat query. Basically I want to display all the graph occurrences where the count hit 0 and stayed like that.

base search | timechart count by URL limit=100

That's where I am and there are some URL hits which were active at certain time then count was 0. I am searching through more than 1 URL and only want those whose count was zero after specific time.
alt text

0 Karma

renjith_nair
Legend

Hi @muralianup,

Try this

base search | timechart count by URL limit=100|untable _time URL count|where (count = 0 AND _time<your_time_filter)
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

renjith_nair
Legend

Hi @muralianup,

Did this work for you?

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...