Splunk Search

need to delete column from the result generated after timechart command

venky1544
Builder

i have a timechart query which is giving me the below result 

i want to exclude the columns with Zero like 02gdysjska2 ,2shbhsiskdf9

Not these names can change and or not fixed 

_time003hfhdfs89huk02gdysjska213hdgsgtsjwk21dhsysbaisps2shbhsiskdf95hsusbsosv
2024-01-23T09:45:00.000+0000000000
2024-01-23T09:50:00.000+0000000000
2024-01-23T09:55:00.000+00000001796100
2024-01-23T10:00:00.000+0000001183000
2024-01-23T10:05:00.000+00000000055
2024-01-23T10:10:00.000+0000000000
2024-01-23T10:15:00.000+0000000000
2024-01-23T10:20:00.000+0000000000
2024-01-23T10:25:00.000+0000428000000
2024-01-23T10:30:00.000+0000000000
2024-01-23T10:35:00.000+0000000000
Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| untable _time name value
| where value != 0
| xyseries _time name value
| fillnull value=0

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| untable _time name value
| where value != 0
| xyseries _time name value
| fillnull value=0
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...