Hi .
I have a sourcetype = Queue and i'm sending the number of messages waiting in the queue .
index=monitoring sourcetype=Qeueue Account=azbcd ( QueueName="test123") | timechart max(MessageCount) as MessageCount span=30minute
But if the number of messages = 0 i'm not sending any data to Splunk ( Actually if i'll not find a solution i'll fix my code to send 0 but i want to avoid that )
Look at the picture you can see that when the messageCount=0 i have a "hole" in the graph .
Is there a way to add if condition or something else that will say if we don't have data put 0 ?
Thanks ,
Amit
You can use Zero
option for "Null Values" in Format tab. Refer doc:
https://docs.splunk.com/Documentation/Splunk/7.0.3/Viz/LineAreaCharts#Configuration_options
Hello,
Can you try this please,
index=monitoring sourcetype=Qeueue Account=azbcd ( QueueName="test123") | timechart max(MessageCount) as MessageCount span=30minute | fillnull value=0
Also you can use make continous command:
https://docs.splunk.com/Documentation/Splunk/7.0.3/SearchReference/Makecontinuous
Regards
You can use Zero
option for "Null Values" in Format tab. Refer doc:
https://docs.splunk.com/Documentation/Splunk/7.0.3/Viz/LineAreaCharts#Configuration_options
Thank you !
The command equivalent for this would be | fillull value=0
to be added after the timechart command.