Zeroes instead of "no result found"

[petreb]

Hello,

I have the search below which should graph the count of the error messages grouped by criticality; the visualisation is "single value" with trellis split by criticality.

it all works as long as there are values found. when there are no events found for one criticality value, the trellis graph not displayed; when events for both criticality values aren't found, the "no results found" message is displayed.

I'm looking for a way to simulate the fillnull function in the case of missing events; I have tried the solutions with makeresults and appendpipe (as described here, here and here), but none worked for me.

The goal is to have zeroes for each time period automatially calculated by timechart where the events are missing. I guess the count column cannot be initialised somehow, as long as there is no value for the selected time period (the "search criticality = ...." subsearch)

cheers

index=<index> source=<source> 
| rex ".\d{3}Z\s(app|batchrun\s-\s\w+)\s(?<loglevel>1|2|3|4|5)\s"
| eval criticality=case(loglevel == "1", "error", loglevel == "2", "warning", loglevel == "3", "info", loglevel == "4", "debug")
| search criticality = error OR criticality = info OR criticality = warning
| timechart count by criticality

[thambisetty]

Since you have fixed values for criticality and I assume, your search returns only one row of results not more than one row at any point of time.

| append 
    [| makeresults 
    | fields - _time 
    | eval error="0",info="0",warning="0"] 
| stats values(*) as *
| foreach * [eval  <<FIELD>> = if(isnull(mvindex(<<FIELD>>,1)),mvindex(<<FIELD>>,0),mvindex(<<FIELD>>,1))]

[petreb]

as you said, it works for a single row; however, I am interested to make it work over the whole timeframe where the count() applied; what I want to achieve is to have two more columns (warning + error) in the table below - is it possible?

	_time	info
1	2020-09-22 14:00:00	66
2	2020-09-22 14:30:00	56
3	2020-09-22 15:00:00	64
4	2020-09-22 15:30:00	56
5	2020-09-22 16:00:00	66