Assuming I have the following log entries
2014-11-01 foo=bar
2014-11-02 foo=bax
With the search | timechart span=1d count
only the days get plottet where actually an entries exists, but not on that days that have been happening since the last entry and now.
Is there a simple way to fill those gaps?
Hi zaphod1984,
take a look at this answer to get more details
http://answers.splunk.com/answers/176466/how-to-use-eval-if-there-is-no-result-from-the-bas-1.html
but you can do something like this:
... | stats count AS myCount by foo, _time | timechart span=1d sum(myCount) AS count
this way you would get a 0
for days with no events.
hope this helps ...
cheers, MuS
Hi zaphod1984,
take a look at this answer to get more details
http://answers.splunk.com/answers/176466/how-to-use-eval-if-there-is-no-result-from-the-bas-1.html
but you can do something like this:
... | stats count AS myCount by foo, _time | timechart span=1d sum(myCount) AS count
this way you would get a 0
for days with no events.
hope this helps ...
cheers, MuS
that's it, thanks!
i was hoping that there would be some kind of a parameter for timechart...
any ideas on how to accompilish this when it comes to averages, medians etc. instead of a simple count?
take a look at the docs http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/CommonStatsFunctions for all available functions for timechart
hi i know the methods that are available but a search like this would not be accurate anymore when using the approach mentioned above: ... | stats p90(foo) AS myP90Foo _time | timechart span=1d p90(myP90Foo) AS p90Foo
the stats
is only there to create empty event counts not to do any aggregation or such, do all this in your timechart