Displaying a blank timechart in a dashboard panel when no results found.

[jason_hotchkiss]

I am working with a time chart panel in a dashboard.  This dashboard will have a filter for "hosts".  However, this particular sourcetype has a small subset of the servers included in the filter.  I would like this panel to display a blank chart if the filtered server is not part of the values for the dashboards other values.  This is what I have written so far:

<base search>
| search host IN ($host$)
| timechart max(users) by host usenull=f useother=f limit=6
| addtotals
| table _time, host
| fillnull host

What happens here is that only the blank time chart (even when the correct server is selected).

[jason_hotchkiss · Accepted solution]

I found my answer in this thread: https://community.splunk.com/t5/Splunk-Search/Timecharts-and-how-to-avoid-quot-no-results-found-insp...

<base search>
| search host IN ($host$)
| timechart max(users) by host usenull=f useother=f limit=6
| addtotals
| table _time, host
| fillnull host
| appendpipe
[stats count
| eval NoResult=""
| where count=0
| fields - count]