How to enhance column chart

[a_vobard]

Hello,

I have created this search filter:

index=reg host=mp1 "export_successful" | TIMECHART count by "import_successful".

Out of this I have created a column chart for visualization - see below. A the moment it is visualized, if there is every day an successful export (every day there is just one), but I would like to see also, if the export was not successful. What is the easiest way to do it?

Thank you, ava

[ITWhisperer]

index=reg host=mp1 "export_successful" | timechart count by "export_successful" | eval export_unsuccessful=if(isnull(count),1,null())

[a_vobard]

Hello, what does this do exactly? I cannot interpret the "if" part. Thank you.

[ITWhisperer]

It is supposed to give you an unsuccessful count for when there isn't a  successful count, but this isn't going to work unless you fill in the time gaps, so try this

index=reg host=mp1 "export_successful" | timechart count by "export_successful" | makecontinuous _time | eval export_unsuccessful=if(isnull(count),1,null())

[a_vobard]

Unfortunately this puts a 1 in every column of "export_unsuccessful".

[kamlesh_vaghela]

@a_vobard 

You can do it with same search. So can you please let us know  like "export_successful " events , how do you identify the export unsuccessful?

KV

[a_vobard]

Hello, there is no event, if an export was not successful.  The only way it can be evaluated is, when the "successful" event is missing. So that seems tricky for me.

Ava

[kamlesh_vaghela]

Then try creating dummy field unsuccessful_export when count is 0.

| eval unsuccessful_export=if(count==0,1,0)

You can put any count instead of 1 as per your requirement.

🙂 

[a_vobard]

This unfortunately doesn't work. I have everywhere just zero's.

[a_vobard]

What exactly is the one?