Dashboards & Visualizations

How to force timechart to display zero for null values?

mikefoti
Communicator

I'd like to display the "user count" on a timechart over a 30 day period such that even when only a single day has a count above zero, my line graph will still look like a colored line moving along the base of the x axis until a single spike appears on the day there was a count about zero. Without this, I simply get a dot on a blank page.

I could use a bar graph, but even so, it provides no perspective since the left and right limits (day1 and day 30) dont even show a date value


my search...


index=myindex
action="what im looking for"
| bin span=1d _time 
| stats DC(user) as "user_count" by _time

Labels (1)
0 Karma
1 Solution

yeahnah
Motivator

HI @mikefoti 

Try using the timechart command instead, I think it will fix your issues

index=myindex action="what im looking for"
| timechart span=1m DC(user) as "user_count"

 
Hope this helps

View solution in original post

srauhala_splunk
Splunk Employee
Splunk Employee

In the settings of the visualization you can choose to set 0 for null values. 

 

0 Karma

yeahnah
Motivator

HI @mikefoti 

Try using the timechart command instead, I think it will fix your issues

index=myindex action="what im looking for"
| timechart span=1m DC(user) as "user_count"

 
Hope this helps

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...