Splunk Search

makecontinuous not working for first/initial time span

VS0909
Communicator

If I run the below query for last 7 days, and if there is no data in logs matching condition index=abc "searchTerm" for day1, then the results are showing for day2 to day7.

But I want a row in resultset for day1 as well, if no data then with TotalResults as 0 for day1.

index=abc "searchTerm"  | bucket _time span=1d | stats count as TotalResults by _time | makecontinuous _time | fillnull TotalResults

Please help

 

0 Karma

VS0909
Communicator

@ITWhisperer  Thanks for the reply!

Can you please help with the complete query here, considering day1 and day7 and also days in between, as same problem may happen for other days as well.

Appreciate your help

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

makecontinuous works between the lowest value in the field and the highest value in the field - you will need to add (append) a dummy entry for day 1 with TotalResults value of 0. I would then sum the TotalResults by _time (in case there was already a result for day 1, then do the makecontinous etc.

VS0909
Communicator

@ITWhisperer  Thanks for the reply!

Can you please help with the complete query here, considering day1 and day7 and also days in between, as same problem may happen for other days as well.

Appreciate your help

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| append 
    [| makeresults
    | addinfo
    | rename info_min_time as _time
    | bin _time span=1d
    | fields - info_*]
| sort _time
| makecontinuous _time span=1d
| fillnull value=0 TotalResults
| stats sum(TotalResults) as TotalResults by _time
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Laser Bananas and Edge Hubs: Exploring Operational Technology (OT) Data Through a ...

  OT is a different environment to traditional IT and can have interesting challenges when interfacing the ...

Event Series: Mastering AI Tokenomics and Splunk Agent Observability

Beyond the Black Box: Correlating AI Performance and Tokenomics with Splunk Agent Observability   As ...

span_metrics: The OpenTelemetry-Idiomatic Way to See Inside Your Services

You open a trace in Splunk Observability Cloud and everything looks fine. One root span, order-pipeline, with ...