Splunk Search

timechart: fill values in empty slots

zaphod1984
Path Finder

Assuming I have the following log entries

2014-11-01 foo=bar
2014-11-02 foo=bax

With the search | timechart span=1d count only the days get plottet where actually an entries exists, but not on that days that have been happening since the last entry and now.
Is there a simple way to fill those gaps?

0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi zaphod1984,

take a look at this answer to get more details
http://answers.splunk.com/answers/176466/how-to-use-eval-if-there-is-no-result-from-the-bas-1.html

but you can do something like this:

... | stats count AS myCount by foo, _time | timechart span=1d sum(myCount) AS count

this way you would get a 0 for days with no events.

hope this helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi zaphod1984,

take a look at this answer to get more details
http://answers.splunk.com/answers/176466/how-to-use-eval-if-there-is-no-result-from-the-bas-1.html

but you can do something like this:

... | stats count AS myCount by foo, _time | timechart span=1d sum(myCount) AS count

this way you would get a 0 for days with no events.

hope this helps ...

cheers, MuS

zaphod1984
Path Finder

that's it, thanks!
i was hoping that there would be some kind of a parameter for timechart...

0 Karma

zaphod1984
Path Finder

any ideas on how to accompilish this when it comes to averages, medians etc. instead of a simple count?

0 Karma

MuS
SplunkTrust
SplunkTrust

take a look at the docs http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/CommonStatsFunctions for all available functions for timechart

0 Karma

zaphod1984
Path Finder

hi i know the methods that are available but a search like this would not be accurate anymore when using the approach mentioned above: ... | stats p90(foo) AS myP90Foo _time | timechart span=1d p90(myP90Foo) AS p90Foo

0 Karma

MuS
SplunkTrust
SplunkTrust

the stats is only there to create empty event counts not to do any aggregation or such, do all this in your timechart

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...