https://community.splunk.com/t5/Splunk-Search/How-to-use-timechart-to-display-whether-a-log-exists-or-not-over/m-p/644588#M223235 <P>Assuming that you are using line chart, and you want the value to be 1 when log exists and 0 when there is no log during the bucket, something like this will do</P><LI-CODE lang="markup">| tstats count where source=cloud_log earliest=-3h latest=+2h by _time span=15m | timechart sum(eval(if(count &gt; 0, 1, 0))) as has_log | fillnull value=0</LI-CODE><P>If you only want to display line on the zero axis and don't care how the column look like, you can skip fillnull, just set visualization to touch zero.</P><P>&nbsp;</P> Thu, 25 May 2023 07:00:50 GMT yuanliu 2023-05-25T07:00:50Z https://community.splunk.com/t5/Splunk-Search/How-to-use-timechart-to-display-whether-a-log-exists-or-not-over/m-p/644489#M223213 <P>I am trying to write a search that displays a table that shows whether a log in cloud watch exists or not every 15 minutes over a 5 hour period. The caveat being that I would like it to show a 0 for time intervals that don’t have the log even if they’re in the future. I’m also having trouble formatting the result table so that the time intervals are the columns/x axis and the count is row/y-axis.</P> <P>Any help would be greatly appreciated, thanks!</P> Wed, 24 May 2023 15:03:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-timechart-to-display-whether-a-log-exists-or-not-over/m-p/644489#M223213 JohnCM8181 2023-05-24T15:03:05Z https://community.splunk.com/t5/Splunk-Search/How-to-use-timechart-to-display-whether-a-log-exists-or-not-over/m-p/644588#M223235 <P>Assuming that you are using line chart, and you want the value to be 1 when log exists and 0 when there is no log during the bucket, something like this will do</P><LI-CODE lang="markup">| tstats count where source=cloud_log earliest=-3h latest=+2h by _time span=15m | timechart sum(eval(if(count &gt; 0, 1, 0))) as has_log | fillnull value=0</LI-CODE><P>If you only want to display line on the zero axis and don't care how the column look like, you can skip fillnull, just set visualization to touch zero.</P><P>&nbsp;</P> Thu, 25 May 2023 07:00:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-timechart-to-display-whether-a-log-exists-or-not-over/m-p/644588#M223235 yuanliu 2023-05-25T07:00:50Z