I am monitoring firewall and everything works fine when all host are producing logs. If a host happens to go offline and doesn't produce logs for an entire day it disappears from my column chart and I would like to have it still show the host but maybe without "bar graph".
Search string: index=name sourcetype="dell:firewall" earliest=-1d@d latest=@d | chart count(eval(pri=1)) AS Emergency, count(eval(pri=2)) AS Alert, count(eval(pri=3)) AS Critical, count(eval(pri=4)) AS Error, count(eval(pri=5)) AS Warning, count(eval(pri=6)) AS Notification, count(eval(pri=7)) AS Informational, count(eval(pri=8)) AS Debugging, by host
I've tried adding fillnull value=0 as well as a few other options but none seem to keep the host listed as a "by host" field when no logs are produced. I tried to attached two screenshots to this ticket not sure if they posted correctly.
... View more