Splunk Search

How do you visualize 'zero' value in an area?

hyeongn
Engager

Hello, I'm a Korean beginner, Splunker

index=my sourcetype=my2 sernder_ip=my3

| table _time | stats count by _time | sort - _time


Here, even if the data is zero, I want to visualize the graph 

 

help me plz

Labels (1)
Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @hyeongn,

I asked to Splunk designers (using "Splunk Ideas") to add a feature to display zero instead of "no results" in panels and this idea is in evaluation, if you think that it could be a good idea, vote for it!

Anyway, in the meantime, you could use something like this:

index=my sourcetype=my2 sernder_ip=my3
| stats count by _time 
| append [ | makeresults | eval count=0 ]
| stats sum(count) AS count by _time  
| sort - _time

Ciao.

Giuseppe

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

An area chart will show zero if it is in the data - I suspect your issue is that if there are no events for a particular time, your don't have a zero count for that time. This is because you have used stats. Try timechart instead

index=my sourcetype=my2 sernder_ip=my3

| timechart count
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @hyeongn,

I asked to Splunk designers (using "Splunk Ideas") to add a feature to display zero instead of "no results" in panels and this idea is in evaluation, if you think that it could be a good idea, vote for it!

Anyway, in the meantime, you could use something like this:

index=my sourcetype=my2 sernder_ip=my3
| stats count by _time 
| append [ | makeresults | eval count=0 ]
| stats sum(count) AS count by _time  
| sort - _time

Ciao.

Giuseppe

Get Updates on the Splunk Community!

AI for AppInspect

We’re excited to announce two new updates to AppInspect designed to save you time and make the app approval ...

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...