https://community.splunk.com/t5/Splunk-Search/How-to-return-0-when-the-search-has-no-results-in-time-chart/m-p/298998#M90112 <P>I am trying to see how can we return 0 if no results are found using timechart for a span of 30minutes.i tried using fill null but its not working</P> <PRE><CODE>index=abc sourcetype=qwe HTTP_Code=502 |timechart span=30m count |fillnull value=0 </CODE></PRE> <P>but when I am using a stats command I get the count as 0.</P> <PRE><CODE>index=abc sourcetype=qwe HTTP_Code=502 |stats count </CODE></PRE> <P>output<BR /> count-0</P> Wed, 23 Aug 2017 17:15:51 GMT vrmandadi 2017-08-23T17:15:51Z https://community.splunk.com/t5/Splunk-Search/How-to-return-0-when-the-search-has-no-results-in-time-chart/m-p/298998#M90112 <P>I am trying to see how can we return 0 if no results are found using timechart for a span of 30minutes.i tried using fill null but its not working</P> <PRE><CODE>index=abc sourcetype=qwe HTTP_Code=502 |timechart span=30m count |fillnull value=0 </CODE></PRE> <P>but when I am using a stats command I get the count as 0.</P> <PRE><CODE>index=abc sourcetype=qwe HTTP_Code=502 |stats count </CODE></PRE> <P>output<BR /> count-0</P> Wed, 23 Aug 2017 17:15:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-return-0-when-the-search-has-no-results-in-time-chart/m-p/298998#M90112 vrmandadi 2017-08-23T17:15:51Z https://community.splunk.com/t5/Splunk-Search/How-to-return-0-when-the-search-has-no-results-in-time-chart/m-p/298999#M90113 <P>try using <CODE>|makecontinuous span=30m _time |timechart span=30m count</CODE> </P> <P><A href="https://docs.splunk.com/Documentation/SplunkCloud/6.6.0/SearchReference/Makecontinuous">https://docs.splunk.com/Documentation/SplunkCloud/6.6.0/SearchReference/Makecontinuous</A></P> Wed, 23 Aug 2017 18:01:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-return-0-when-the-search-has-no-results-in-time-chart/m-p/298999#M90113 cmerriman 2017-08-23T18:01:33Z https://community.splunk.com/t5/Splunk-Search/How-to-return-0-when-the-search-has-no-results-in-time-chart/m-p/299000#M90114 <P>No luck with that</P> Wed, 23 Aug 2017 18:05:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-return-0-when-the-search-has-no-results-in-time-chart/m-p/299000#M90114 vrmandadi 2017-08-23T18:05:28Z https://community.splunk.com/t5/Splunk-Search/How-to-return-0-when-the-search-has-no-results-in-time-chart/m-p/299001#M90115 <P>Try like this</P> <PRE><CODE>index=abc sourcetype=qwe HTTP_Code=502 |timechart span=30m count | appendpipe [| stats count | where count=0 | addinfo | eval _time=info_min_time | table _time count] </CODE></PRE> <P><STRONG>Updated</STRONG></P> <PRE><CODE>index=abc sourcetype=qwe HTTP_Code=502 |timechart span=30m count | appendpipe [| stats count | where count=0 | addinfo | eval time=info_min_time." ".info_max_time | table time count | makemv time| mvexpand time | rename time as _time | timechart span=30m max(count) as count] </CODE></PRE> Wed, 23 Aug 2017 18:13:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-return-0-when-the-search-has-no-results-in-time-chart/m-p/299001#M90115 somesoni2 2017-08-23T18:13:17Z https://community.splunk.com/t5/Splunk-Search/How-to-return-0-when-the-search-has-no-results-in-time-chart/m-p/299002#M90116 <P>I tried this but the output gives you only one time, I am trying to break down into buckets of 30 minutes</P> Wed, 23 Aug 2017 19:03:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-return-0-when-the-search-has-no-results-in-time-chart/m-p/299002#M90116 vrmandadi 2017-08-23T19:03:53Z https://community.splunk.com/t5/Splunk-Search/How-to-return-0-when-the-search-has-no-results-in-time-chart/m-p/299003#M90117 <P>Try the updated answer</P> Wed, 23 Aug 2017 19:20:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-return-0-when-the-search-has-no-results-in-time-chart/m-p/299003#M90117 somesoni2 2017-08-23T19:20:29Z https://community.splunk.com/t5/Splunk-Search/How-to-return-0-when-the-search-has-no-results-in-time-chart/m-p/299004#M90118 <P>That worked thank you very much you are always helpful</P> Wed, 23 Aug 2017 19:29:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-return-0-when-the-search-has-no-results-in-time-chart/m-p/299004#M90118 vrmandadi 2017-08-23T19:29:06Z https://community.splunk.com/t5/Splunk-Search/How-to-return-0-when-the-search-has-no-results-in-time-chart/m-p/299005#M90119 <P>the update one is the one works for me !</P> Mon, 20 Jan 2020 04:31:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-return-0-when-the-search-has-no-results-in-time-chart/m-p/299005#M90119 jackw_splunk 2020-01-20T04:31:26Z