Splunk Search

Can we set different charting.nullValueMode for different chart in same graph

disha
Contributor

sourcetype="agent"
| spath path="EID" output=EventID
| search EventID=3
| spath path="SID" output=SID
|search SID="aaa-bbb"
| spath path="MU" output=mu
| eval mu=(mu/1024)|eval mu=round(mu,2)
| timechart first(mu) as "Memory Usage(MB)"|appendcols [search sourcetype="agent"
| spath path="EID" output=EventID
| search EventID=3
| spath path="SID" output=SID
|search SID="aaa-bbb" |spath path="DBG" output=Debug |eval n=25|timechart first(n) by Debug]

  1. I want for first timechart null values "connect" and for second one I need nullvalues "gap" or I need column chart for second timechart.
    I am trying line
    column
    connect
    OR
    line
    connect
    gap
    Nothing is working. Please help.

  2. Also I need to filter results where Debug!="{}"
    Any Suggestion Please?This is urgent.

Tags (1)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Concerning number one, set the chart to omit null values and compute your own connect for the other chart like this:

...  | streamstats count(f) as temp | streamstats count by temp | eventstats max(count) as max by temp | streamstats last(f) as last | reverse | streamstats last(f) as next | reverse | eval f = if(isnull(f),last+((next-last)/max)*(count-1),f) | fields - temp count max last next

To keep things looking nice, call your first(mu) as f at first, and later rename it - else you'd have the human-readable field all over the query.

Concerning number two, something like this?

... | where Debug!="{}"
0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...