Dashboards & Visualizations

Show black data in a chart when there is no data

robertlynch2020
Influencer

Hi 

I have the following data that gives me the below graph, however, if the data stops coming in I want to see "black steps" to the rights, to show the use there is no more data.

So ideally I want a time chart, as this will happen naturally do this, but not sure how to get this from the query that I have.

Another option is to keep time filling till now() and then put in a fill null for all the values to = 0.

robertlynch2020_0-1627482477319.png

robertlynch2020_1-1627482554882.png

 

| mstats max("mx.process.cpu.utilization") as cpuPerc max("mx.process.threads") as nbOfThreads max("mx.process.memory.usage") as memoryCons max("mx.process.file_descriptors") as nbOfOpenFiles avg("mx.process.up.time") as upTime avg("mx.process.creation.time") as creationTime WHERE "index"="metrics_test" AND mx.env=http://mx20267vm:15000 span=1000s BY pid 
| foreach * 
    [ eval <<FIELD>>=if(<<FIELD>> > .0000001, 1 ,0)]

 

 

Any help would be great thanks

Labels (2)
0 Karma
1 Solution

robertlynch2020
Influencer

Solved

 

| mstats max("mx.process.cpu.utilization") as cpuPerc max("mx.process.threads") as nbOfThreads max("mx.process.memory.usage") as memoryCons max("mx.process.file_descriptors") as nbOfOpenFiles avg("mx.process.up.time") as upTime avg("mx.process.creation.time") as creationTime WHERE "index"="metrics_test" AND mx.env=http://mx20267vm:15000 span=1m BY pid 
| foreach * 
    [ eval <<FIELD>>=if(<<FIELD>> > .0000001, 1 ,0)] 
| timechart max(cpuPerc) as  cpuPerc , max(nbOfThreads) as nbOfThreads | fillnull

View solution in original post

0 Karma

robertlynch2020
Influencer

Solved

 

| mstats max("mx.process.cpu.utilization") as cpuPerc max("mx.process.threads") as nbOfThreads max("mx.process.memory.usage") as memoryCons max("mx.process.file_descriptors") as nbOfOpenFiles avg("mx.process.up.time") as upTime avg("mx.process.creation.time") as creationTime WHERE "index"="metrics_test" AND mx.env=http://mx20267vm:15000 span=1m BY pid 
| foreach * 
    [ eval <<FIELD>>=if(<<FIELD>> > .0000001, 1 ,0)] 
| timechart max(cpuPerc) as  cpuPerc , max(nbOfThreads) as nbOfThreads | fillnull
0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...