How to display graph column for zero value

[tmaurst]

I have a bar graph that charts two values. When one of the values is 0, the graph removes the column altogether. This makes it difficult to ascertain that two values are being compared. How can I keep a placeholder for a 0 value in the graph with the field name intact?

Thanks

[woodcock · Accepted solution]

This is the Sentinel Search problem discussed (with solution) here:

https://conf.splunk.com/session/2015/conf2015-LookupTalk.pdf

[tmaurst]

Thanks. However I'm having a bit of trouble with the sentinel value implementation (found on pages 25-27).

index=myIndex AND sourcetype=mySource AND ("string1" OR "string2") | eval split=if(match(_raw, ".*string1*."), "Requests", "Timeouts") | inputlookup append=true Timeouts | chart count by split

The above query returns 'The lookup table Timeouts is invalid'. What am I missing?

[woodcock]

If you are creating an ad-hoc lookup, you must use Timeouts.csv. When you specify a lookup without .csv on the end, Splunk looks for a Lookup definition named, in this case, Timeouts, to see if it is a Lookup file or a KV Store. It does not find such and gives you this error. The other way around it is to create a lookup definition calledTimeouts that is file-based as Timeouts.csv.

Don't forget to click Accept to close the question.