topic Re: How to show the line when its value is NULL with chart command / chartコマンドで行の値が0の時表示する方法 in Splunk Search

How to show the line when its value is NULL with chart command / chartコマンドで行の値が0の時表示する方法

mint_choco — Sat, 03 May 2025 09:50:32 GMT

Hi, I try to display the number of events per day from multiple indexes.

I wrote the below SPL, but when all index values are null for a specific date, the line itself is not displayed.

複数のindexから、nullには0を代入し、1日ごとのイベント件数を表示させたいです。

chartコマンドを使いイベント件数を表示、特定indexの値がnullの場合はisnullで0を代入できたのですが、特定の日にちだけ全てのindexの値がnullの時、その日の行自体が表示されません。

index IN (index1, index2, index3, index4) | bin span=1d _time | chart count _time over index | eval index4=if(isnull(index4), 0, index4)

How to display a line of 4/2 by substituting 0 like the below table, when all indexes value of 4/2 are null?

下記の表のように4/2の値がなくとも、０を代入して4/2の行を表示させる方法はないでしょうか。

	index1	index2	index3	index4
4/1	12	3	45	0
4/2	0	0	0	0
4/3	16	7	34	0

Re: How to show the line when its value is NULL with chart command / chartコマンドで行の値が0の時表示する方法

livehybrid — Tue, 06 May 2025 08:50:10 GMT

Hi @mint_choco

I believe you can either use filldown or fillnull here.
After your chart command you could use the following, note that you *might not* have to specify all of the fields here, but if you do not specify them then it will only fillnull fields which already exist, therefore if no values for index4 are found then index4 would not appear at all in your chart.

| fillnull index1 index2 index3 index4 value=0

If you prefer to use the previous value in its place then use filldown:

| filldown

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: How to show the line when its value is NULL with chart command / chartコマンドで行の値が0の時表示する方法

ITWhisperer — Tue, 06 May 2025 14:01:00 GMT

| addtotals fieldname=_total | where _total > 0

Re: How to show the line when its value is NULL with chart command / chartコマンドで行の値が0の時表示する方法

mint_choco — Thu, 08 May 2025 17:14:11 GMT

Hi, @livehybrid

Thanks your reply. Unfortunately, it didn't work.

I can fill the col index4 by using fillnull, instead of "| eval index4=if(isnull(index4), 0, index4)".
But, I got the table like below. The line for 4/2 still missing.

_time	index1	index2	index3	index4
4/1	12	3	45	0
4/3	16	7	34	0
4/4	15	6	70	0

There is no logs on April 2nd, so there is no line for 4/2, I guess.
Is there no way to make line for April 2nd? Maybe should I try without chart command?

Re: How to show the line when its value is NULL with chart command / chartコマンドで行の値が0の時表示する方法

livehybrid — Thu, 08 May 2025 19:57:51 GMT

Hi @mint_choco

Before the fillnull you culd try using "makecontinuous"

Something like this (adjust accordingly):

| makecontinuous _time span=1d

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: How to show the line when its value is NULL with chart command / chartコマンドで行の値が0の時表示する方法

mint_choco — Fri, 09 May 2025 15:51:56 GMT

@livehybrid

"makecontinuous" - This is exactly what I need!

I didn't know there is such useful command.
My question is solved.

Thank you!