: NULL in legend

[ctallarico20]

Hi, I'm wondering why the search "RESULTS"| timechart span=1d sum(SUCCESS) as "Successes" sum(FAILURE) as "Failures" by RESULTS displays a : NULL in the legend. For example, my legend reads SUCCESSES: NULL and FAILURES: NULL although the data is displayed correctly/ I think this has something to do with the fact that my logs don't always have both a success and fail count, it's usually one or the other.

[ctallarico20]

you got it! thank you so much!

[Gilberto_Castil · Accepted solution]

Thanks for posting the sample data. I can replicate the condition you describe. The culprit is the "by RESULTS" clause because it is trying to group the results by the field RESULTS. Try this:

"RESULTS"| timechart span=1d sum(SUCCESS) as "Successes" sum(FAILURE) as "Failures"

[ctallarico20]

[2013-06-03 11:38:40:66 EDT] RESULTS FAILURE=5
[2013-06-03 11:38:40:66 EDT] RESULTS SUCCESS=15

[Gilberto_Castil]

This points to the data extraction not having the right context. Would you be able to quote two or three lines from the tabular display?

[ctallarico20]

I appreciate the help, but I believe this only filters the result "NULL" from the timechart. I have the suffix ": NULL" added to all of my data

[Gilberto_Castil]

The timechart command has an optional flag to avoid NULL values. Try this:

 ... "RESULTS" | timechart span=1d sum(SUCCESS) as "Successes" sum(FAILURE) as "Failures" by RESULTS usenull=false

---

gc