Splunk Search

How to replace time series chart giving no results

kirrusk
Communicator

Hi All,

I created single value panels using a time-series chart. If there is no data it's display's "no results found"

But I want to display "0(zero)" instead of no results.

Can any help how to do this.

index = *  sourcetype=*   procount=* phase=*  |  timechart span=10m count(eval(phase="running") as dd 

Labels (4)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@kirrusk 

Can you please try this?

index = *  sourcetype=*   procount=* phase=*  |  timechart span=10m count(eval(phase="running")) as dd | appendcols [| makeresults | eval dd="0"] 

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| appendpipe [stats count | where count = 0]
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@kirrusk 

Can you please try this?

index = *  sourcetype=*   procount=* phase=*  |  timechart span=10m count(eval(phase="running")) as dd | appendcols [| makeresults | eval dd="0"] 
Get Updates on the Splunk Community!

Splunk MCP & Agentic AI: Machine Data Without Limits

  Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization ...

Finding Based Detections General Availability

Overview  We’ve come a long way, folks, but here in Enterprise Security 8.4 I’m happy to announce Finding ...

Get Your Hands Dirty (and Your Shoes Comfy): The Splunk Experience

Hands-On Learning and Technical Seminars  Sometimes, you just need to see the code. For those looking for a ...