I'm trying to show all the source types within the last 24 hours (I set that by using presets), and if those source types have no data, I still want to show the name of the soucetype but with 0 (represent no data).
This is what I'm doing now, but it only shows the source types with data for the last 24 hours.
index=* |chart count over sourcetype
|eval name=if(count=="0", "0", "1")
Please help. I searched everywhere and tried so many things but still no luck. Also, I'm trying to use the trellis visualization to represent those source types