topic Re: Dashboard | Add Value in Splunk Search

How to display the bar with both values even when there are no results for failed?

splunkuser320 — Thu, 13 Apr 2023 16:34:42 GMT

I have a bar graph that shows the status (Success and failed). I want to display the bar with both values even when there are no results for failed. Currently, it shows a bar with only success status.

Re: Dashboard | Add Value

ITWhisperer — Thu, 13 Apr 2023 05:49:48 GMT

Please share your current SPL, preferably in a code block </>

Re: Dashboard | Add Value

gcusello — Thu, 13 Apr 2023 06:37:04 GMT

Hi @splunkuser320 ,

as @ITWhisperer said, if you could share your code, it's easier to help you, anyway, supposing your code, you could use something like this:

<your_search> | timechart count BY host | eval failed=if(isnull(failed),0,failed), success=if(isnull(success),0,success)

Ciao.

Giuseppe