How to show computer in horizontal chart event if there are 0 events

[LyDang]

I want to have a graph where where you can easily see when that system is no longer taking kerberos authentications.  But when it doesn't show anything for over 12h, then that object is no longer in that graph. Is there a way to keep my servers showing even if there are 0 events for that time period?

index=perfmon source="Perfmon:Security System-Wide Statistics" counter="Kerberos Authentications" earliest=-12h latest=now
[inputlookup Prod_DC.csv]
| eval host=lower(host)
|bucket span=5m time | stats count by _time,host|eval count=if(count>0,1,0)
|timechart span=5m limit=0 last(count) by host

[bowesmana]

To show something that doesn't exist means you have to add that 'known' component back in. That means after your search you have to add back all the hosts you expect to see. If your hosts are in Prod_DC.csv you will need to append that data then massage the results with something like the method below for a simple stats collection

....
| append [
  | inputlookup Prod_DC.csv
  | eval count=0
]
| stats max(count) as count by host

[LyDang]

The problem is that I have:

|bucket span=5m time | stats count by _time,host|eval count=if(count>0,1,0)

I think this put events in 5m time slots.

I want a chart that will tell me every 5 minutes if 1/There are any events or 2/There are 0 events.

Also to have the server on the list if 0 events for that 12 hours.

[bowesmana · Accepted solution]

This is another way of appending the columns for any MISSING hosts entirely.

The first timechart + fillnull will create the gaps for all hosts found, but then the final appendcols will add in columns for any missing hosts

| makeresults count=50
| eval _time=now()-((random() % 62) * 60)
| eval host=mvindex(split("hosta,hostb,hostc",","), random() % 3) 
| bin _time span=5m 
| stats count by _time,host
| eval count=if(count>0,1,0)
|timechart span=5m limit=0 last(count) by host
| fillnull
| appendcols [
  | makeresults
  | eval host=split("hosta,hostb,hostc,hostd",",")
  | mvexpand host
  | eval count=0
  | chart values(count) as count over _time by host
]
| filldown

 Hopefully these will give you something to work with

[LyDang]

That works for me! Many thanks 😀

[bowesmana]

Here's one example of how to fill in gaps

| makeresults count=50
| eval _time=now()-((random() % 60) * 60)
| eval host=mvindex(split("hosta,hostb,hostc",","), random() % 3) 
| bin _time span=5m 
| stats count by _time,host
| eval count=if(count>0,1,0)
| append [
  | makeresults
  | eval host=split("hosta,hostb,hostc",",")
  | addinfo
  | eval time_window = info_max_time - info_min_time
  | eval bin_count = round(time_window / 300)
  | mvexpand host
  | eval bins=mvrange(1, bin_count + 1, 1)
  | mvexpand bins
  | eval _time=now() - (bins * 300)
  | eval count = 0, dummy=1
  | fields _time host count 
]
| bin _time span=5m 
| stats max(count) as count by _time,host
|timechart span=5m limit=0 last(count) by host

It generates the additional check data in the append by taking all the 'known' hosts and creating extra rows on the end for each 5 minute bin within the search window, and then stats joins them back together - then you can use your timechart at the end

There's probably another way to fill the gaps - there always is with Splunk