How to display the bar with both values even when there are no results for failed?

[splunkuser320]

I have a bar graph that shows the status (Success and failed). I want to display the bar with both values even when there are no results for failed.  Currently, it shows a bar with only success status. 

[gcusello · Accepted solution]

Hi @splunkuser320 ,

as @ITWhisperer said, if you could share your code, it's easier to help you, anyway, supposing your code, you could use something like this:

<your_search>
| timechart count BY host 
| eval 
   failed=if(isnull(failed),0,failed), 
   success=if(isnull(success),0,success)

Ciao.

Giuseppe

[ITWhisperer]

Please share your current SPL, preferably in a code block </>