I am trying to show a graph based on a "count by", but where columns are still shown, even if no result returned.
For example, I have the following stats:
In this example, the problem is I have no result for values 4 to 9. So, when representing results, I have the following graph:
Is there a way so I can show columns, even for empty results, but still with a count=0 (so not adding fake events).
Thank you in advance.
... | stats count by seconds | append [|gentimes start=-1 | eval seconds=(0, 10, 1) | mvexpand seconds | table seconds] | fillnull count value=0 | dedup seconds | sort seconds
Thanks for the answer 🙂
In the meantime, I found almost the same solution. Didn't do it with a list but with multiple "append" which is not as sexy.