Splunk Search

Dots/gaps in timechart when using sum(packets) by destination

splunklearner12
Path Finder

When I use "(base search) | timechart sum(packets) by destination useother=f usenull=f", I get gaps in my timechart:

alt text

When I use a longer time frame of 1 day, I also get gaps:
alt text

In another timechart, I have the exact same base search and just "| timechart sum(packets)", and it has no gaps. I found that when I add "by destination" to this one, it also gets the gaps/dots.
As far as I can see on https://docs.splunk.com/Documentation/Splunk/7.3.0/SearchReference/Timechart timechart should convert null values to 0 by default...
Any ideas?

0 Karma
1 Solution

adonio
Ultra Champion

under visualization -> click format -> general tab -> click on connect in "Null Value" line

see attached screenshot
alt text

View solution in original post

0 Karma

adonio
Ultra Champion

under visualization -> click format -> general tab -> click on connect in "Null Value" line

see attached screenshot
alt text

0 Karma

splunklearner12
Path Finder

Thank you for that simple solution. I found the second option called "Zero" looked nicer though!

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...