I want to build a pie chart showing which values are present for a certain field (country below). But, I want the pie chart to also include a section showing how many of the events that completely lack this field.
The following search gives me all events I am interested in for the Pie Chart "total".
index=starbug service=my-service line.req.headers.referer=*\/endpoint*
Sometimes, the referrer field contains a query parameter, which is the field I'm interested in, for my pie chart sections, and I can extract the value like so:
index=starbug service=my-service line.req.headers.referer=*\/endpoint* | rex field=line.req.headers.referer "country=(?<country>.{2})"
However, when turning this into a chart...
index=starbug service=my-service line.req.headers.referer=\/endpoint | rex field=line.req.headers.referer "country=(?.{2})" | chart count by country
...the pie chart "ignores" the events that don't have a value for country.
but what I'm expecting is something like this:
SE 20%
NO 10%
null 70% (this is the one that is missing)
I've tried things like usenull=t
and useother=t
, but it's not changing anything, so I think I'm misunderstanding something here.
@twalander,
Try replacing the real null with a "NULL" string .
For e.g.
index=starbug service=my-service line.req.headers.referer=*\/endpoint* | rex field=line.req.headers.referer "country=(?<country>.{2})" |fillnull value=NULL | chart count by country
@twalander,
Try replacing the real null with a "NULL" string .
For e.g.
index=starbug service=my-service line.req.headers.referer=*\/endpoint* | rex field=line.req.headers.referer "country=(?<country>.{2})" |fillnull value=NULL | chart count by country
Thanks that's exactly what I needed! 🙂