I have created this search filter:
index=reg host=mp1 "export_successful" | TIMECHART count by "import_successful".
Out of this I have created a column chart for visualization - see below. A the moment it is visualized, if there is every day an successful export (every day there is just one), but I would like to see also, if the export was not successful. What is the easiest way to do it?
Thank you, ava
It is supposed to give you an unsuccessful count for when there isn't a successful count, but this isn't going to work unless you fill in the time gaps, so try this
index=reg host=mp1 "export_successful" | timechart count by "export_successful" | makecontinuous _time | eval export_unsuccessful=if(isnull(count),1,null())