How to return 0 when the search has no results in time chart

[vrmandadi]

I am trying to see how can we return 0 if no results are found using timechart for a span of 30minutes.i tried using fill null but its not working

index=abc  sourcetype=qwe HTTP_Code=502 |timechart span=30m count |fillnull value=0

but when I am using a stats command I get the count as 0.

index=abc  sourcetype=qwe HTTP_Code=502 |stats count

output
count-0

[somesoni2 · Accepted solution]

Try like this

index=abc sourcetype=qwe HTTP_Code=502 |timechart span=30m count | appendpipe [| stats count | where count=0 | addinfo | eval _time=info_min_time | table _time count]

Updated

index=abc sourcetype=qwe HTTP_Code=502 |timechart span=30m count | appendpipe [| stats count | where count=0 | addinfo | eval time=info_min_time." ".info_max_time | table time count | makemv time| mvexpand time | rename time as _time | timechart span=30m max(count) as count]

[vrmandadi]

I tried this but the output gives you only one time, I am trying to break down into buckets of 30 minutes

[somesoni2]

Try the updated answer

[jackw_splunk]

the update one is the one works for me !

[vrmandadi]

That worked thank you very much you are always helpful

[cmerriman]

try using |makecontinuous span=30m _time |timechart span=30m count

https://docs.splunk.com/Documentation/SplunkCloud/6.6.0/SearchReference/Makecontinuous

[vrmandadi]

No luck with that