topic Re: Show empty timechart with global_time date range in Splunk Search

How can I show empty timechart with global_time date range?

vmpj — Fri, 21 Oct 2022 14:44:33 GMT

I have three graphs that show results based on a global time range.
However, if I have no results (no errors) the third graph is not displayed.

I just want to display an empty graph with the same date ranges as the other graphs without displaying artificially inserted results that could be intepreted as errors.

None of the many posts regarding this issue solved my problem as far as I understand it.

Thanks in advance.

Re: Show empty timechart with global_time date range

johnhuang — Fri, 21 Oct 2022 14:22:04 GMT

What's the search query?

Re: Show empty timechart with global_time date range

vmpj — Mon, 24 Oct 2022 14:30:43 GMT

Something like this:

Thanks.

Re: Show empty timechart with global_time date range

vmpj — Mon, 24 Oct 2022 14:38:45 GMT

Put another way;

If I select a time range that does not contain any events,
how can I still see a graph for the selected time range, even though it does not contain any data?

Re: Show empty timechart with global_time date range

johnhuang — Mon, 24 Oct 2022 15:08:29 GMT

For your example, there's an easy solution. Run fillnull:

| eval status = case(match(log,"(?i).*successfully.*"),"Success", match(log,".*"),"Failed")
| table _time, status
| fillnull value=0 status

Re: Show empty timechart with global_time date range

vmpj — Tue, 25 Oct 2022 09:37:35 GMT

I can see how fillnull would be helpful if some events did not have a status value.
However, that is not the problem I'm trying to solve.

Here is a simplified scenario where the status is set for all events:

index="applications-esl" | eval status = "Success" | table _time, status

But there are no events, in the time range selected, there is nothing to fill.
In this case I just get a "No results found. Try expanding the time range." when I really want an empty graph that reflects the selected time range on the x-axis.

Re: Show empty timechart with global_time date range

johnhuang — Tue, 25 Oct 2022 13:26:35 GMT

Ok, this should work. Note the trick is to set event_ct=1 for real data and event_ct=0 for fake data, then generate fake data if there aren't any results. When you summarize it, you would use sum(event_ct) instead of count.