topic Re: Single Condition to use in dashboard to plot a graph in both situations if value>=1 or value=0 in Dashboards & Visualizations

Single Condition to use in dashboard to plot a graph in both situations if value>=1 or value=0

dkdeepshikhaa — Tue, 16 Jul 2019 14:28:51 GMT

Currently, i am getting graph if value >=1 but if value is 0 than dashboard gives No result found on screen, is it possible to plot it on X-axis (like overlapping )showing value 0

Re: Single Condition to use in dashboard to plot a graph in both situations if value>=1 or value=0

adonio — Tue, 16 Jul 2019 17:40:55 GMT

many answers in this portal for this question, here are couple that i think you will find useful:
also try ... your search ... | timechart ... | fillnull value=0 <your_field>

https://answers.splunk.com/answers/608870/how-to-display-0-instead-of-no-results-found.html
https://answers.splunk.com/answers/582253/replacing-no-results-found-with-0.html
https://answers.splunk.com/answers/336907/return-0-if-search-returns-no-results-found.html

Re: Single Condition to use in dashboard to plot a graph in both situations if value>=1 or value=0

dkdeepshikhaa — Wed, 17 Jul 2019 08:09:51 GMT

Thank you @adonio, i looked for the answer on the portal, they are for printing the value, i need to plot it

below is query , i am getting result if positive value is there but if no value than " no result found" message on the screen

index=*...........
| eval success1=if(success="true", 1, 0)
| eval fail1=if(success="false", 1, 0)
| stats sum(success1) as SC, sum(fail1) as FC by field...........
| eval total1=SCount+FCount
| timechart sum(total1) as Total sum(SC) as Success sum(FC) as Fail

||fillnull value=0
| eval "percentage"

if i could get some idea on what to modify in this to get required result