Display value in chart even if count if zero

[treinke]

Looking to do a chart and even if the count of a value is 0 still diplay the name of the value. My search so far is:
sourcetype=app3* (app3_level="Fatal" OR app3_level="Error") | chart count by app3_level,app3_message

I tried to add to the end of the statement but it didn't help.
| fillnull value=0 app3_level

Most of the time there is not a "app3_level=Fatal" but I still want it to show up in the column. Any ideas?

[somesoni2 · Accepted solution]

Try this

sourcetype=app3* (app3_level="Fatal" OR app3_level="Error") | chart count by app3_level,app3_message  | append [| gentimes start=-1 | eval app3_level="Fatal Error" | table app3_level | makemv app3_level | mvexpand app3_level ] | fillnull value=0 | stats max(*) as * by app3_level,app3_message