Results of Bar chart for no events happened ?

[sumanth_isac]

Hi,
The chart in search app shows events when did it happen.
eg. 1 bar = 1 hour

If there are no events in next hour no bar.
When there is no event in hour i want the bar to be in different colour. Is that possible ?

[jonuwz]

Yes.

Assuming that you do

... | timechart span=1h count 

Add this to your search (after the timechart):

... | eval filler=if(isnull(count),1,NULL)

then change your column graph to stacked.

'filler' and 'count' will have different colors, and either 'filler' or 'count' will be displayed because only 1 is not null.