Dashboards & Visualizations

Show black data in a chart when there is no data

robertlynch2020
Influencer

Hi 

I have the following data that gives me the below graph, however, if the data stops coming in I want to see "black steps" to the rights, to show the use there is no more data.

So ideally I want a time chart, as this will happen naturally do this, but not sure how to get this from the query that I have.

Another option is to keep time filling till now() and then put in a fill null for all the values to = 0.

robertlynch2020_0-1627482477319.png

robertlynch2020_1-1627482554882.png

 

| mstats max("mx.process.cpu.utilization") as cpuPerc max("mx.process.threads") as nbOfThreads max("mx.process.memory.usage") as memoryCons max("mx.process.file_descriptors") as nbOfOpenFiles avg("mx.process.up.time") as upTime avg("mx.process.creation.time") as creationTime WHERE "index"="metrics_test" AND mx.env=http://mx20267vm:15000 span=1000s BY pid 
| foreach * 
    [ eval <<FIELD>>=if(<<FIELD>> > .0000001, 1 ,0)]

 

 

Any help would be great thanks

Labels (2)
0 Karma
1 Solution

robertlynch2020
Influencer

Solved

 

| mstats max("mx.process.cpu.utilization") as cpuPerc max("mx.process.threads") as nbOfThreads max("mx.process.memory.usage") as memoryCons max("mx.process.file_descriptors") as nbOfOpenFiles avg("mx.process.up.time") as upTime avg("mx.process.creation.time") as creationTime WHERE "index"="metrics_test" AND mx.env=http://mx20267vm:15000 span=1m BY pid 
| foreach * 
    [ eval <<FIELD>>=if(<<FIELD>> > .0000001, 1 ,0)] 
| timechart max(cpuPerc) as  cpuPerc , max(nbOfThreads) as nbOfThreads | fillnull

View solution in original post

0 Karma

robertlynch2020
Influencer

Solved

 

| mstats max("mx.process.cpu.utilization") as cpuPerc max("mx.process.threads") as nbOfThreads max("mx.process.memory.usage") as memoryCons max("mx.process.file_descriptors") as nbOfOpenFiles avg("mx.process.up.time") as upTime avg("mx.process.creation.time") as creationTime WHERE "index"="metrics_test" AND mx.env=http://mx20267vm:15000 span=1m BY pid 
| foreach * 
    [ eval <<FIELD>>=if(<<FIELD>> > .0000001, 1 ,0)] 
| timechart max(cpuPerc) as  cpuPerc , max(nbOfThreads) as nbOfThreads | fillnull
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...