How can I show empty timechart with global_time date range?

[vmpj]

I have three graphs that show results based on a global time range.
However, if I have no results (no errors) the third graph is not displayed.

I just want to display an empty graph with the same date ranges as the other graphs without displaying artificially inserted results that could be intepreted as errors.

None of the many posts regarding this issue solved my problem as far as I understand it.

Thanks in advance.

[johnhuang]

What's the search query?

[vmpj]

Something like this:

index="applications-esl" 
| spath input=properties.message
| rename message.id as s4-uuid
| eval _time=strptime(time, "%FT%T.%QZ")
| sort +_time limit=0
| stats 
  last(_time) as _time,
  list(logMsg) as log,
  by s4-uuid
| eval status = case(match(log,"(?i).*successfully.*"),"Success", match(log,".*"),"Failed")
| table _time, status
| search status="Success"
| timechart span=1m count

Thanks.

[vmpj]

Put another way;

If I select a time range that does not contain any events,
how can I still see a graph for the selected time range, even though it does not contain any data? 

[johnhuang]

For your example, there's an easy solution. Run fillnull:

| eval status = case(match(log,"(?i).*successfully.*"),"Success", match(log,".*"),"Failed")
| table _time, status
| fillnull value=0 status

[vmpj]

I can see how fillnull would be helpful if some events did not have a status value.
However, that is not the problem I'm trying to solve. 

Here is a simplified scenario where the status is set for all events:

index="applications-esl" 
| eval status = "Success"
| table _time, status

But there are no events, in the time range selected, there is nothing to fill.
In this case I just get a "No results found. Try expanding the time range." when I really want an empty graph that reflects the selected time range on the x-axis.

[johnhuang]

Ok, this should work. Note the trick is to set event_ct=1 for real data and event_ct=0 for fake data, then generate fake data if there aren't any results. When you summarize it, you would use sum(event_ct) instead of count.

<base_search>
| eval event_ct=1
| appendpipe [stats count | addinfo | eval _time=info_max_time
| where count=0 | eval event_ct=0 | fields _time event_ct]
| timechart span=10m sum(event_ct) AS event_ct
| fillnull value=0 event_ct

<base_search>
| eval event_ct=1
| appendpipe [stats count | addinfo | eval _time=info_max_time 
| where count=0 | eval event_ct=0 | fields _time event_ct] 
| timechart span=10m sum(event_ct) AS event_ct
| fillnull value=0 event_ct