How do I make a piechart that shows an additional section for events that "miss" value for a given field?

[twalander]

I want to build a pie chart showing which values are present for a certain field (country below). But, I want the pie chart to also include a section showing how many of the events that completely lack this field.

The following search gives me all events I am interested in for the Pie Chart "total".

index=starbug service=my-service line.req.headers.referer=*\/endpoint*

Sometimes, the referrer field contains a query parameter, which is the field I'm interested in, for my pie chart sections, and I can extract the value like so:

index=starbug service=my-service line.req.headers.referer=*\/endpoint* | rex field=line.req.headers.referer "country=(?<country>.{2})"

However, when turning this into a chart...

index=starbug service=my-service line.req.headers.referer=\/endpoint | rex field=line.req.headers.referer "country=(?.{2})" | chart count by country
...the pie chart "ignores" the events that don't have a value for country.

but what I'm expecting is something like this:

SE           20%
NO         10% 
null         70% (this is the one that is missing)

I've tried things like usenull=t and useother=t , but it's not changing anything, so I think I'm misunderstanding something here.

[renjith_nair · Accepted solution]

@twalander,

Try replacing the real null with a "NULL" string .

For e.g.

  index=starbug service=my-service line.req.headers.referer=*\/endpoint* | rex field=line.req.headers.referer "country=(?<country>.{2})" |fillnull value=NULL | chart count by country

[twalander]

Thanks that's exactly what I needed! 🙂