Splunk Search

replace or hide aggregate 0s in timechart

zdavitiani_splu
Splunk Employee
Splunk Employee

I have a search that returns number of apache processes per host:

sourcetype="ps" earliest="-7m" | multikv filter apache | search USER="apache" | timechart span=30s count as linecount_apache by host

However, this results in 0 values for some hosts for last or first rows when, presumably, some data is out of range or isn't available yet. What would be the best way to hide or replace these 0s with nulls so they are not displayed on the report? Piping to eval or replace like this:

| eval linecount_apache=if(linecount_apache==0,null,linecount_apache)

seemed to have no effect on the result. Thank you.

Tags (3)
1 Solution

araitz
Splunk Employee
Splunk Employee

Use the 'partial' argument to timechart:

| timechart span=30s count as linecount_apache by host partial=f

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Timechart

partial
    Syntax: partial=<bool> 
    Description: Controls if partial time buckets should be retained or not. Only the first and last
    bucket could ever be partial. Defaults to True|T, meaning that they are retained. 

View solution in original post

araitz
Splunk Employee
Splunk Employee

Use the 'partial' argument to timechart:

| timechart span=30s count as linecount_apache by host partial=f

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Timechart

partial
    Syntax: partial=<bool> 
    Description: Controls if partial time buckets should be retained or not. Only the first and last
    bucket could ever be partial. Defaults to True|T, meaning that they are retained. 

sophy
Splunk Employee
Splunk Employee

Hi! You can use the fillnull command, as described in this topic:

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/fillnull

to fill the empty field values with NULL:

... | fillnull value=NULL

before the timechart command, for example:

... | fillnull linecount_apache=NULL | timechart span=30s count as linecount_apache by host

Hope this helps!

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...