Splunk Search
Highlighted

count null timechart spans

Explorer

Hi,

I have the following search that displays a table with time as rows and conferenceID as columns. i only want to include conferenceIDs (columns) where the sum > 1 and there are at least 2 non-zero spans.

My search:

index=myindex sourcetype=mysourcetype
| timechart span=7d count by ConferenceID limit=0 where sum > 1

I want to keep column 1, but not column 2:

          1001     1002
wk1         1        2
wk2         0        0
wk3         1        0
wk4         0        0
0 Karma
Highlighted

Re: count null timechart spans

SplunkTrust
SplunkTrust

Give this a try

index=myindex sourcetype=mysourcetype
| bucket span=7d _time
| stats count by _time ConferenceID
| eventstats dc(_time) as weeks by ConferenceID 
| where weeks>=2
| timechart span=7d sum(count) by ConferenceID limit=0 

View solution in original post

Highlighted

Re: count null timechart spans

Explorer

Thanks somesoni2. works like a charm.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.