Splunk Search

need to delete column from the result generated after timechart command

venky1544
Builder

i have a timechart query which is giving me the below result 

i want to exclude the columns with Zero like 02gdysjska2 ,2shbhsiskdf9

Not these names can change and or not fixed 

_time003hfhdfs89huk02gdysjska213hdgsgtsjwk21dhsysbaisps2shbhsiskdf95hsusbsosv
2024-01-23T09:45:00.000+0000000000
2024-01-23T09:50:00.000+0000000000
2024-01-23T09:55:00.000+00000001796100
2024-01-23T10:00:00.000+0000001183000
2024-01-23T10:05:00.000+00000000055
2024-01-23T10:10:00.000+0000000000
2024-01-23T10:15:00.000+0000000000
2024-01-23T10:20:00.000+0000000000
2024-01-23T10:25:00.000+0000428000000
2024-01-23T10:30:00.000+0000000000
2024-01-23T10:35:00.000+0000000000
Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| untable _time name value
| where value != 0
| xyseries _time name value
| fillnull value=0

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| untable _time name value
| where value != 0
| xyseries _time name value
| fillnull value=0
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk, and empower your SOC to reach new heights! Duration: 1 hour  Prepare to ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...