https://community.splunk.com/t5/Splunk-Search/Display-value-in-chart-even-if-count-if-zero/m-p/158862#M44792 <P>Try this</P> <PRE><CODE>sourcetype=app3* (app3_level="Fatal" OR app3_level="Error") | chart count by app3_level,app3_message | append [| gentimes start=-1 | eval app3_level="Fatal Error" | table app3_level | makemv app3_level | mvexpand app3_level ] | fillnull value=0 | stats max(*) as * by app3_level,app3_message </CODE></PRE> Mon, 15 Dec 2014 18:09:07 GMT somesoni2 2014-12-15T18:09:07Z https://community.splunk.com/t5/Splunk-Search/Display-value-in-chart-even-if-count-if-zero/m-p/158861#M44791 <P>Looking to do a chart and even if the count of a value is 0 still diplay the name of the value. My search so far is:<BR /> <CODE>sourcetype=app3* (app3_level="Fatal" OR app3_level="Error") | chart count by app3_level,app3_message</CODE></P> <P>I tried to add to the end of the statement but it didn't help.<BR /> <CODE>| fillnull value=0 app3_level</CODE></P> <P>Most of the time there is not a "app3_level=Fatal" but I still want it to show up in the column. Any ideas?</P> Mon, 15 Dec 2014 17:03:22 GMT https://community.splunk.com/t5/Splunk-Search/Display-value-in-chart-even-if-count-if-zero/m-p/158861#M44791 treinke 2014-12-15T17:03:22Z https://community.splunk.com/t5/Splunk-Search/Display-value-in-chart-even-if-count-if-zero/m-p/158862#M44792 <P>Try this</P> <PRE><CODE>sourcetype=app3* (app3_level="Fatal" OR app3_level="Error") | chart count by app3_level,app3_message | append [| gentimes start=-1 | eval app3_level="Fatal Error" | table app3_level | makemv app3_level | mvexpand app3_level ] | fillnull value=0 | stats max(*) as * by app3_level,app3_message </CODE></PRE> Mon, 15 Dec 2014 18:09:07 GMT https://community.splunk.com/t5/Splunk-Search/Display-value-in-chart-even-if-count-if-zero/m-p/158862#M44792 somesoni2 2014-12-15T18:09:07Z