$alertGroup$ and $Node$ are two drop down variables. While changing drop down values,the value of these variables changes.
Problem is, i want to display chart on page load and on page load the values of these two variables are null and my query is returning null value. I want to set the default value of these variables as "Any". By default all the results should show in graph.
Assuming you are using Advanced XML StaticSelect or SearchSelect Lister modules with ConvertToIntention, you can add an "Any" option like so (basically the value for the "Any" options is "*"; If you still want to see events that don't have an AlertGroup field you would need to add a "| fillnull" to your search):
thanks for the suggestions. I have implemented this query. But it is giving zero result.
index="tougou" sourcetype="alert" AlertGroup=$alertGroup$ Node=$Node$ | fields LastOccurrence, Severity, Node, Location, AlertGroup, Summary | timechart count(LastOccurrence) by Severity | fillnull value="Any"