Dashboards & Visualizations

display '0' in single value with timechart

Mike6960
Path Finder

My search displays 'no results'

index=* sourcetype="CKBG"
| where CB != GB
| timechart count span=1d

When I use statscount instead it displays '0' . This also what I need. Ik palyed around with fillnull but dont seem to get it working

Tags (1)
0 Karma

mayurr98
Super Champion

Try like this

index=* sourcetype="CKBG"
| where CB != GB
| timechart span=1d count  | appendpipe [| stats count | where count=0 | addinfo | eval _time=info_min_time | table _time count]

OR

 index=* sourcetype="CKBG"
| where CB != GB
| timechart span=1d count | appendpipe [| stats count | where count=0 | addinfo | eval time=info_min_time." ".info_max_time | table time count | makemv time| mvexpand time | rename time as _time | timechart span=1d max(count) as count]

let me know if this helps!

Mike6960
Path Finder

Thanks, the first one works. Don't really understand how it works but thats beside the point. Only thing is that it does not show a trendline now. Second one does not display results.

0 Karma

mayurr98
Super Champion

what is your exact query?

0 Karma

Mike6960
Path Finder

the one i put in my question

0 Karma

Mike6960
Path Finder

I used this one (yours)
index=* sourcetype="CKBG"
| where CB != GB
| timechart span=1d count | appendpipe [| stats count | where count=0 | addinfo | eval _time=info_min_time | table _time count]

0 Karma

mayurr98
Super Champion

how will it show trendline automatically? you would need to use trendline command at the end of the query right?

0 Karma

Mike6960
Path Finder

No, trendline is selected in 'menu' 'formatting visualisation'

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Can you please look at this answer:
https://answers.splunk.com/answers/176466/how-to-use-eval-if-there-is-no-result-from-the-bas-1.html
It might give you an answer.

0 Karma

Mike6960
Path Finder

This answers 'talks' about when there is no result. I have a result, but that is '0' . Besides that, I use a timechart which isn't mentioned in the answer

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...