display '0' in single value with timechart

[Mike6960]

My search displays 'no results'

index=* sourcetype="CKBG"
| where CB != GB
| timechart count span=1d

When I use statscount instead it displays '0' . This also what I need. Ik palyed around with fillnull but dont seem to get it working

[mayurr98]

Try like this

index=* sourcetype="CKBG"
| where CB != GB
| timechart span=1d count  | appendpipe [| stats count | where count=0 | addinfo | eval _time=info_min_time | table _time count]

OR

 index=* sourcetype="CKBG"
| where CB != GB
| timechart span=1d count | appendpipe [| stats count | where count=0 | addinfo | eval time=info_min_time." ".info_max_time | table time count | makemv time| mvexpand time | rename time as _time | timechart span=1d max(count) as count]

let me know if this helps!

[Mike6960]

Thanks, the first one works. Don't really understand how it works but thats beside the point. Only thing is that it does not show a trendline now. Second one does not display results.

[mayurr98]

what is your exact query?

[Mike6960]

the one i put in my question

[Mike6960]

I used this one (yours)
index=* sourcetype="CKBG"
| where CB != GB
| timechart span=1d count | appendpipe [| stats count | where count=0 | addinfo | eval _time=info_min_time | table _time count]

[mayurr98]

how will it show trendline automatically? you would need to use trendline command at the end of the query right?

[Mike6960]

No, trendline is selected in 'menu' 'formatting visualisation'

[kamlesh_vaghela]

Can you please look at this answer:
https://answers.splunk.com/answers/176466/how-to-use-eval-if-there-is-no-result-from-the-bas-1.html
It might give you an answer.

[Mike6960]

This answers 'talks' about when there is no result. I have a result, but that is '0' . Besides that, I use a timechart which isn't mentioned in the answer