Hi,
The chart in search app shows events when did it happen.
eg. 1 bar = 1 hour
If there are no events in next hour no bar.
When there is no event in hour i want the bar to be in different colour. Is that possible ?
Yes.
Assuming that you do
... | timechart span=1h count
Add this to your search (after the timechart):
... | eval filler=if(isnull(count),1,NULL)
then change your column graph to stacked.
'filler' and 'count' will have different colors, and either 'filler' or 'count' will be displayed because only 1 is not null.