Hello everyone !
I've two panels depending on time (timechart) :
1)
index=XXX sourcetype="XXXXX" Severity="*" |timechart count(Severity) span=6h
On the picture, this one is right : it only shows between the two times where there is values and hide if the last days where there is no value ! (there is nothing between now and the 4 may at 14:00)
2)
index=XXX sourcetype="XXXXX" Severity="CRITICAL" |timechart count as CRIT span=6h
| appendcols [search
index=XXX sourcetype="XXXXX" Severity="FATAL" |timechart count as FATAL span=6h ]
| appendcols [search
index=XXX sourcetype="XXXXX" Severity="WARNING" |timechart count as WARN span=6h ]
| table CRIT, FATAL, WARN, _time
On the second graph, it shows the values between now and the 4 may at 14:00 and marks them as 0. I want to hide these values (and make the graph auto resize like the previous one if possible) because these are not relevant and i want to keep the same time range for both graphs :
Thanks for your help !
Why not condense the search?
index=XXX sourcetype="XXXXX" (Severity="CRITICAL" OR Severity="WARNING" OR Severity="FATAL") |timechart span=6h count by Severity | rename WARNING AS WARN | rename CRITICAL AS CRIT
Why not condense the search?
index=XXX sourcetype="XXXXX" (Severity="CRITICAL" OR Severity="WARNING" OR Severity="FATAL") |timechart span=6h count by Severity | rename WARNING AS WARN | rename CRITICAL AS CRIT
It was what i was looking for !
Thanks 🙂