Splunk Search
Highlighted

How to display a value of zero in a chart for negative values returned in a search?

New Member

Hi Everyone,

Need some help on how to display the output value as zero in a chart when a negative result is returned.

Thank you
Kind regards,

Tags (2)
0 Karma
Highlighted

Re: How to display a value of zero in a chart for negative values returned in a search?

SplunkTrust
SplunkTrust

If I understand correctly, you just want to return 0 if the value is negative, right?
If that's the case:

your base search
| eval myNewValue = if(oldValue < 0, 0, oldValue)
| chart foo bar by myNewValue

If not please provide an example

0 Karma