Splunk Search

need to delete column from the result generated after timechart command

venky1544
Builder

i have a timechart query which is giving me the below result 

i want to exclude the columns with Zero like 02gdysjska2 ,2shbhsiskdf9

Not these names can change and or not fixed 

_time003hfhdfs89huk02gdysjska213hdgsgtsjwk21dhsysbaisps2shbhsiskdf95hsusbsosv
2024-01-23T09:45:00.000+0000000000
2024-01-23T09:50:00.000+0000000000
2024-01-23T09:55:00.000+00000001796100
2024-01-23T10:00:00.000+0000001183000
2024-01-23T10:05:00.000+00000000055
2024-01-23T10:10:00.000+0000000000
2024-01-23T10:15:00.000+0000000000
2024-01-23T10:20:00.000+0000000000
2024-01-23T10:25:00.000+0000428000000
2024-01-23T10:30:00.000+0000000000
2024-01-23T10:35:00.000+0000000000
Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| untable _time name value
| where value != 0
| xyseries _time name value
| fillnull value=0

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| untable _time name value
| where value != 0
| xyseries _time name value
| fillnull value=0
Get Updates on the Splunk Community!

A Guide To Cloud Migration Success

As enterprises’ rapid expansion to the cloud continues, IT leaders are continuously looking for ways to focus ...

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...