Splunk Search

need to delete column from the result generated after timechart command

venky1544
Builder

i have a timechart query which is giving me the below result 

i want to exclude the columns with Zero like 02gdysjska2 ,2shbhsiskdf9

Not these names can change and or not fixed 

_time003hfhdfs89huk02gdysjska213hdgsgtsjwk21dhsysbaisps2shbhsiskdf95hsusbsosv
2024-01-23T09:45:00.000+0000000000
2024-01-23T09:50:00.000+0000000000
2024-01-23T09:55:00.000+00000001796100
2024-01-23T10:00:00.000+0000001183000
2024-01-23T10:05:00.000+00000000055
2024-01-23T10:10:00.000+0000000000
2024-01-23T10:15:00.000+0000000000
2024-01-23T10:20:00.000+0000000000
2024-01-23T10:25:00.000+0000428000000
2024-01-23T10:30:00.000+0000000000
2024-01-23T10:35:00.000+0000000000
Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| untable _time name value
| where value != 0
| xyseries _time name value
| fillnull value=0

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| untable _time name value
| where value != 0
| xyseries _time name value
| fillnull value=0
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...