index=abc |chart sum(" Views") by "Site" ,"Event Date" | fillnull value=0
how can I display only those rows which have the fillnull value
Give this a try
index=abc |chart sum("Views") by "Site_Section" ,"Event Date" | fillnull value=0
| eval hasZero="No" | foreach * [| eval hasZero=if("<<MATCHSTR>>"!="Site_Section" AND '<<FIELD>>'=0,"Yes",hasZero) ]
| where hasZero="Yes" | fields - hasZero
@vrmandadi, do you need the rows which have all 0s or at-least one zero for various "Event Date"?
Also if possible what is the format of "Event Date"? Can you add some sample data output for above query?
I just added an image ,and yes I need all the rows with 0s