topic Re: Chart force line chart to show zero when no results in Splunk Search

Chart force line chart to show zero when no results

markgomez00 — Thu, 10 Oct 2013 11:39:58 GMT

Hi, I have a realtime chart that monitors the current messages in queue,

my search string right now is

  host=host1 sourcetype="Perfmon:MSMQ Queue" "instance=instance2" OR "instance=instance1"

sometimes no results are returned due to the queue having 0 messages for over a long period of time,
Is it possible on splunk line chart to force it to show 0 value when no results are returned?

thanks in advance

Re: Chart force line chart to show zero when no results

alacercogitatus — Thu, 10 Oct 2013 11:55:55 GMT

host=host1 sourcetype="Perfmon:MSMQ Queue" instance="instance2" OR instance="instance1" | stats count

This will show the current count of events, even when it's 0. Is there a specific counter you are looking for?

Re: Chart force line chart to show zero when no results

Simon_Fishel — Thu, 10 Oct 2013 21:02:15 GMT

If I'm understanding you correctly, you'd like a timechart of how many messages you are receiving over time. If so, try this:

host=host1 sourcetype="Perfmon:MSMQ Queue" instance="instance2" OR instance="instance1" | timechart count

Re: Chart force line chart to show zero when no results

the_wolverine — Thu, 13 Feb 2014 18:30:55 GMT

http://answers.splunk.com/answers/118496/fill-in-0-for-timechart-with-missing-values

Re: Chart force line chart to show zero when no results

sansay — Wed, 26 Nov 2014 01:47:05 GMT

It really depends on your timechart statement. Assuming that you measure instance1 and instance2 counts you can force both metrics to appear by adding | fillnull value=0 instance1 instance2 after your timechart statement.