https://community.splunk.com/t5/Splunk-Search/how-to-use-timechart-count-to-return-0-when-value-is-null/m-p/344268#M101971 <P>Add the usenull flag to the timechart command -</P> <PRE><CODE>sourcetype=x OR sourcetype=y OR sourcetype=z | timchart span=1h usenull=true count by sourcetype </CODE></PRE> Mon, 24 Apr 2017 12:52:53 GMT dineshraj9 2017-04-24T12:52:53Z https://community.splunk.com/t5/Splunk-Search/how-to-use-timechart-count-to-return-0-when-value-is-null/m-p/344266#M101969 <P>I am working on a search that returns counts by the hour but when the event has not occur, I would still like to fill in the column with zeros instead of it not appearing at all. I have tried fillnull, eval = if, eval =ifnull and it still has the same behavior. Any ideas? How do I create dummy data for when this occurs. </P> <P>sourcetype=x Or sourcetype=y Or Sourcetype=z |timchart count span=1h by sourcetype</P> Mon, 24 Apr 2017 12:38:58 GMT https://community.splunk.com/t5/Splunk-Search/how-to-use-timechart-count-to-return-0-when-value-is-null/m-p/344266#M101969 lasonyadj 2017-04-24T12:38:58Z https://community.splunk.com/t5/Splunk-Search/how-to-use-timechart-count-to-return-0-when-value-is-null/m-p/344267#M101970 <P>correction:<BR /> sourcetype=x Or sourcetype=y Or Sourcetype=z |timechart count span=1h by sourcetype</P> Mon, 24 Apr 2017 12:48:03 GMT https://community.splunk.com/t5/Splunk-Search/how-to-use-timechart-count-to-return-0-when-value-is-null/m-p/344267#M101970 lasonyadj 2017-04-24T12:48:03Z https://community.splunk.com/t5/Splunk-Search/how-to-use-timechart-count-to-return-0-when-value-is-null/m-p/344268#M101971 <P>Add the usenull flag to the timechart command -</P> <PRE><CODE>sourcetype=x OR sourcetype=y OR sourcetype=z | timchart span=1h usenull=true count by sourcetype </CODE></PRE> Mon, 24 Apr 2017 12:52:53 GMT https://community.splunk.com/t5/Splunk-Search/how-to-use-timechart-count-to-return-0-when-value-is-null/m-p/344268#M101971 dineshraj9 2017-04-24T12:52:53Z https://community.splunk.com/t5/Splunk-Search/how-to-use-timechart-count-to-return-0-when-value-is-null/m-p/344269#M101972 <P>Tried that too, it didn't work either.</P> Mon, 24 Apr 2017 12:56:36 GMT https://community.splunk.com/t5/Splunk-Search/how-to-use-timechart-count-to-return-0-when-value-is-null/m-p/344269#M101972 lasonyadj 2017-04-24T12:56:36Z https://community.splunk.com/t5/Splunk-Search/how-to-use-timechart-count-to-return-0-when-value-is-null/m-p/344270#M101973 <P>Also tried usenull, it didn't work either.</P> Mon, 24 Apr 2017 12:57:08 GMT https://community.splunk.com/t5/Splunk-Search/how-to-use-timechart-count-to-return-0-when-value-is-null/m-p/344270#M101973 lasonyadj 2017-04-24T12:57:08Z https://community.splunk.com/t5/Splunk-Search/how-to-use-timechart-count-to-return-0-when-value-is-null/m-p/344271#M101974 <P>You have to ensure that there is at least 1 event from each of the of sourcetype so that you can see 0 values for those. </P> <P>If any of x or y or z has no events at all in the time range you are searching, they won't show up in the results with 0 values for any of the time range.</P> Mon, 24 Apr 2017 13:01:34 GMT https://community.splunk.com/t5/Splunk-Search/how-to-use-timechart-count-to-return-0-when-value-is-null/m-p/344271#M101974 dineshraj9 2017-04-24T13:01:34Z https://community.splunk.com/t5/Splunk-Search/how-to-use-timechart-count-to-return-0-when-value-is-null/m-p/344272#M101975 <P>So there is no way to pad these sources with zero when there are no events?</P> Mon, 24 Apr 2017 13:07:31 GMT https://community.splunk.com/t5/Splunk-Search/how-to-use-timechart-count-to-return-0-when-value-is-null/m-p/344272#M101975 lasonyadj 2017-04-24T13:07:31Z https://community.splunk.com/t5/Splunk-Search/how-to-use-timechart-count-to-return-0-when-value-is-null/m-p/344273#M101976 <P>Try this -</P> <PRE><CODE> sourcetype=x OR sourcetype=y OR sourcetype=z | timchart span=1h usenull=true count by sourcetype | fillnull value=0 x y z </CODE></PRE> Mon, 24 Apr 2017 13:19:33 GMT https://community.splunk.com/t5/Splunk-Search/how-to-use-timechart-count-to-return-0-when-value-is-null/m-p/344273#M101976 dineshraj9 2017-04-24T13:19:33Z https://community.splunk.com/t5/Splunk-Search/how-to-use-timechart-count-to-return-0-when-value-is-null/m-p/344274#M101977 <P>After you timechart command add:</P> <P>| table _time, sourcetype1, sourcetype2, sourcetype3<BR /> | fillnull sourcetype1, sourcetype2, sourcetype3 </P> <P>This should still display the data as a timechart but creating the missing fields to be subject "fillnull"</P> Mon, 24 Apr 2017 13:21:21 GMT https://community.splunk.com/t5/Splunk-Search/how-to-use-timechart-count-to-return-0-when-value-is-null/m-p/344274#M101977 paulbannister 2017-04-24T13:21:21Z https://community.splunk.com/t5/Splunk-Search/how-to-use-timechart-count-to-return-0-when-value-is-null/m-p/344275#M101978 <P>That works!! Thanks!1</P> Mon, 24 Apr 2017 14:01:06 GMT https://community.splunk.com/t5/Splunk-Search/how-to-use-timechart-count-to-return-0-when-value-is-null/m-p/344275#M101978 lasonyadj 2017-04-24T14:01:06Z https://community.splunk.com/t5/Splunk-Search/how-to-use-timechart-count-to-return-0-when-value-is-null/m-p/344276#M101979 <P>No problem</P> Mon, 24 Apr 2017 14:03:32 GMT https://community.splunk.com/t5/Splunk-Search/how-to-use-timechart-count-to-return-0-when-value-is-null/m-p/344276#M101979 paulbannister 2017-04-24T14:03:32Z https://community.splunk.com/t5/Splunk-Search/how-to-use-timechart-count-to-return-0-when-value-is-null/m-p/344277#M101980 <P>Great! Please be sure to accept the answer that works, and upvote any answers that were helpful. </P> Mon, 24 Apr 2017 15:37:37 GMT https://community.splunk.com/t5/Splunk-Search/how-to-use-timechart-count-to-return-0-when-value-is-null/m-p/344277#M101980 DalJeanis 2017-04-24T15:37:37Z