Splunk Search

timechart return 0 if no results found

amitdaniel
Explorer

Hi .
I have a sourcetype = Queue and i'm sending the number of messages waiting in the queue .

index=monitoring sourcetype=Qeueue Account=azbcd ( QueueName="test123") | timechart max(MessageCount) as MessageCount span=30minute

But if the number of messages = 0 i'm not sending any data to Splunk ( Actually if i'll not find a solution i'll fix my code to send 0 but i want to avoid that )

Look at the picture you can see that when the messageCount=0 i have a "hole" in the graph .
Is there a way to add if condition or something else that will say if we don't have data put 0 ?

alt text

Thanks ,
Amit

Tags (1)
0 Karma
1 Solution

p_gurav
Champion

TISKAR
Builder

Hello,
Can you try this please,

index=monitoring sourcetype=Qeueue Account=azbcd ( QueueName="test123") | timechart max(MessageCount) as MessageCount span=30minute | fillnull value=0

Also you can use make continous command:

https://docs.splunk.com/Documentation/Splunk/7.0.3/SearchReference/Makecontinuous

Regards

0 Karma

p_gurav
Champion

You can use Zero option for "Null Values" in Format tab. Refer doc:
https://docs.splunk.com/Documentation/Splunk/7.0.3/Viz/LineAreaCharts#Configuration_options

amitdaniel
Explorer

Thank you !

0 Karma

niketn
Legend

The command equivalent for this would be | fillull value=0 to be added after the timechart command.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...