Splunk Search

Can we set different charting.nullValueMode for different chart in same graph

disha
Contributor

sourcetype="agent"
| spath path="EID" output=EventID
| search EventID=3
| spath path="SID" output=SID
|search SID="aaa-bbb"
| spath path="MU" output=mu
| eval mu=(mu/1024)|eval mu=round(mu,2)
| timechart first(mu) as "Memory Usage(MB)"|appendcols [search sourcetype="agent"
| spath path="EID" output=EventID
| search EventID=3
| spath path="SID" output=SID
|search SID="aaa-bbb" |spath path="DBG" output=Debug |eval n=25|timechart first(n) by Debug]

  1. I want for first timechart null values "connect" and for second one I need nullvalues "gap" or I need column chart for second timechart.
    I am trying line
    column
    connect
    OR
    line
    connect
    gap
    Nothing is working. Please help.

  2. Also I need to filter results where Debug!="{}"
    Any Suggestion Please?This is urgent.

Tags (1)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Concerning number one, set the chart to omit null values and compute your own connect for the other chart like this:

...  | streamstats count(f) as temp | streamstats count by temp | eventstats max(count) as max by temp | streamstats last(f) as last | reverse | streamstats last(f) as next | reverse | eval f = if(isnull(f),last+((next-last)/max)*(count-1),f) | fields - temp count max last next

To keep things looking nice, call your first(mu) as f at first, and later rename it - else you'd have the human-readable field all over the query.

Concerning number two, something like this?

... | where Debug!="{}"
0 Karma
Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...