https://community.splunk.com/t5/Dashboards-Visualizations/display-0-in-single-value-with-timechart/m-p/307757#M39860 <P>My search displays 'no results' </P> <P>index=* sourcetype="CKBG"<BR /> | where CB != GB<BR /> | timechart count span=1d </P> <P>When I use statscount instead it displays '0' . This also what I need. Ik palyed around with fillnull but dont seem to get it working</P> Mon, 26 Feb 2018 10:33:35 GMT Mike6960 2018-02-26T10:33:35Z https://community.splunk.com/t5/Dashboards-Visualizations/display-0-in-single-value-with-timechart/m-p/307757#M39860 <P>My search displays 'no results' </P> <P>index=* sourcetype="CKBG"<BR /> | where CB != GB<BR /> | timechart count span=1d </P> <P>When I use statscount instead it displays '0' . This also what I need. Ik palyed around with fillnull but dont seem to get it working</P> Mon, 26 Feb 2018 10:33:35 GMT https://community.splunk.com/t5/Dashboards-Visualizations/display-0-in-single-value-with-timechart/m-p/307757#M39860 Mike6960 2018-02-26T10:33:35Z https://community.splunk.com/t5/Dashboards-Visualizations/display-0-in-single-value-with-timechart/m-p/307758#M39861 <P>Can you please look at this answer: <BR /> <A href="https://answers.splunk.com/answers/176466/how-to-use-eval-if-there-is-no-result-from-the-bas-1.html">https://answers.splunk.com/answers/176466/how-to-use-eval-if-there-is-no-result-from-the-bas-1.html</A><BR /> It might give you an answer.</P> Mon, 26 Feb 2018 10:38:56 GMT https://community.splunk.com/t5/Dashboards-Visualizations/display-0-in-single-value-with-timechart/m-p/307758#M39861 kamlesh_vaghela 2018-02-26T10:38:56Z https://community.splunk.com/t5/Dashboards-Visualizations/display-0-in-single-value-with-timechart/m-p/307759#M39862 <P>Try like this</P> <PRE><CODE>index=* sourcetype="CKBG" | where CB != GB | timechart span=1d count | appendpipe [| stats count | where count=0 | addinfo | eval _time=info_min_time | table _time count] </CODE></PRE> <P>OR </P> <PRE><CODE> index=* sourcetype="CKBG" | where CB != GB | timechart span=1d count | appendpipe [| stats count | where count=0 | addinfo | eval time=info_min_time." ".info_max_time | table time count | makemv time| mvexpand time | rename time as _time | timechart span=1d max(count) as count] </CODE></PRE> <P>let me know if this helps!</P> Mon, 26 Feb 2018 10:56:34 GMT https://community.splunk.com/t5/Dashboards-Visualizations/display-0-in-single-value-with-timechart/m-p/307759#M39862 mayurr98 2018-02-26T10:56:34Z https://community.splunk.com/t5/Dashboards-Visualizations/display-0-in-single-value-with-timechart/m-p/307760#M39863 <P>This answers 'talks' about when there is no result. I have a result, but that is '0' . Besides that, I use a timechart which isn't mentioned in the answer</P> Mon, 26 Feb 2018 10:56:52 GMT https://community.splunk.com/t5/Dashboards-Visualizations/display-0-in-single-value-with-timechart/m-p/307760#M39863 Mike6960 2018-02-26T10:56:52Z https://community.splunk.com/t5/Dashboards-Visualizations/display-0-in-single-value-with-timechart/m-p/307761#M39864 <P>Thanks, the first one works. Don't really understand how it works but thats beside the point. Only thing is that it does not show a trendline now. Second one does not display results. </P> Mon, 26 Feb 2018 11:10:29 GMT https://community.splunk.com/t5/Dashboards-Visualizations/display-0-in-single-value-with-timechart/m-p/307761#M39864 Mike6960 2018-02-26T11:10:29Z https://community.splunk.com/t5/Dashboards-Visualizations/display-0-in-single-value-with-timechart/m-p/307762#M39865 <P>what is your exact query?</P> Mon, 26 Feb 2018 11:14:09 GMT https://community.splunk.com/t5/Dashboards-Visualizations/display-0-in-single-value-with-timechart/m-p/307762#M39865 mayurr98 2018-02-26T11:14:09Z https://community.splunk.com/t5/Dashboards-Visualizations/display-0-in-single-value-with-timechart/m-p/307763#M39866 <P>the one i put in my question</P> Mon, 26 Feb 2018 11:16:49 GMT https://community.splunk.com/t5/Dashboards-Visualizations/display-0-in-single-value-with-timechart/m-p/307763#M39866 Mike6960 2018-02-26T11:16:49Z https://community.splunk.com/t5/Dashboards-Visualizations/display-0-in-single-value-with-timechart/m-p/307764#M39867 <P>I used this one (yours) <BR /> index=* sourcetype="CKBG"<BR /> | where CB != GB<BR /> | timechart span=1d count | appendpipe [| stats count | where count=0 | addinfo | eval _time=info_min_time | table _time count]</P> Tue, 29 Sep 2020 18:10:48 GMT https://community.splunk.com/t5/Dashboards-Visualizations/display-0-in-single-value-with-timechart/m-p/307764#M39867 Mike6960 2020-09-29T18:10:48Z https://community.splunk.com/t5/Dashboards-Visualizations/display-0-in-single-value-with-timechart/m-p/307765#M39868 <P>how will it show trendline automatically? you would need to use trendline command at the end of the query right?</P> Mon, 26 Feb 2018 12:04:53 GMT https://community.splunk.com/t5/Dashboards-Visualizations/display-0-in-single-value-with-timechart/m-p/307765#M39868 mayurr98 2018-02-26T12:04:53Z https://community.splunk.com/t5/Dashboards-Visualizations/display-0-in-single-value-with-timechart/m-p/307766#M39869 <P>No, trendline is selected in 'menu' 'formatting visualisation'</P> Mon, 26 Feb 2018 12:18:59 GMT https://community.splunk.com/t5/Dashboards-Visualizations/display-0-in-single-value-with-timechart/m-p/307766#M39869 Mike6960 2018-02-26T12:18:59Z