Hi @hyeongn,
I asked to Splunk designers (using "Splunk Ideas") to add a feature to display zero instead of "no results" in panels and this idea is in evaluation, if you think that it could be a good idea, vote for it!
Anyway, in the meantime, you could use something like this:
index=my sourcetype=my2 sernder_ip=my3
| stats count by _time
| append [ | makeresults | eval count=0 ]
| stats sum(count) AS count by _time
| sort - _time
Ciao.
Giuseppe
An area chart will show zero if it is in the data - I suspect your issue is that if there are no events for a particular time, your don't have a zero count for that time. This is because you have used stats. Try timechart instead
index=my sourcetype=my2 sernder_ip=my3
| timechart count
Hi @hyeongn,
I asked to Splunk designers (using "Splunk Ideas") to add a feature to display zero instead of "no results" in panels and this idea is in evaluation, if you think that it could be a good idea, vote for it!
Anyway, in the meantime, you could use something like this:
index=my sourcetype=my2 sernder_ip=my3
| stats count by _time
| append [ | makeresults | eval count=0 ]
| stats sum(count) AS count by _time
| sort - _time
Ciao.
Giuseppe