Splunk Search

count null timechart spans

mwcooley
Explorer

Hi,

I have the following search that displays a table with time as rows and conferenceID as columns. i only want to include conferenceIDs (columns) where the sum > 1 and there are at least 2 non-zero spans.

My search:

index=myindex sourcetype=mysourcetype
| timechart span=7d count by ConferenceID limit=0 where sum > 1

I want to keep column 1, but not column 2:

          1001     1002
wk1         1        2
wk2         0        0
wk3         1        0
wk4         0        0
0 Karma
1 Solution

somesoni2
Revered Legend

Give this a try

index=myindex sourcetype=mysourcetype
| bucket span=7d _time
| stats count by _time ConferenceID
| eventstats dc(_time) as weeks by ConferenceID 
| where weeks>=2
| timechart span=7d sum(count) by ConferenceID limit=0 

View solution in original post

somesoni2
Revered Legend

Give this a try

index=myindex sourcetype=mysourcetype
| bucket span=7d _time
| stats count by _time ConferenceID
| eventstats dc(_time) as weeks by ConferenceID 
| where weeks>=2
| timechart span=7d sum(count) by ConferenceID limit=0 

View solution in original post

mwcooley
Explorer

Thanks somesoni2. works like a charm.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.