https://community.splunk.com/t5/Splunk-Search/Timechart-show-no-zero-values/m-p/103916#M26874 <P>Use fillnull <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P>index=prd_access sourcetype=access:web:agw earliest=-14d "No ESP" | fillnull value=NoEsp| timechart span=1d count as NoEsp</P> Thu, 17 Oct 2013 12:37:55 GMT mkelderm 2013-10-17T12:37:55Z https://community.splunk.com/t5/Splunk-Search/Timechart-show-no-zero-values/m-p/103915#M26873 <P>My query shows only values when it finds an event. I want also the 0 events per span in my chart. I thought this was working in Splunk&gt; 5.x</P> <P>index=prd_access sourcetype=access:web:agw earliest=-14d "No ESP" | timechart span=1d count</P> <P>Note: We are running Splunk 6.0</P> <P>Regards,</P> <P>Marc</P> Thu, 17 Oct 2013 12:16:40 GMT https://community.splunk.com/t5/Splunk-Search/Timechart-show-no-zero-values/m-p/103915#M26873 mkelderm 2013-10-17T12:16:40Z https://community.splunk.com/t5/Splunk-Search/Timechart-show-no-zero-values/m-p/103916#M26874 <P>Use fillnull <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P>index=prd_access sourcetype=access:web:agw earliest=-14d "No ESP" | fillnull value=NoEsp| timechart span=1d count as NoEsp</P> Thu, 17 Oct 2013 12:37:55 GMT https://community.splunk.com/t5/Splunk-Search/Timechart-show-no-zero-values/m-p/103916#M26874 mkelderm 2013-10-17T12:37:55Z