How to show the line when its value is NULL with chart command / chartコマンドで行の値が0の時表示する方法

[mint_choco]

Hi, I try to display the number of events per day from multiple indexes.

I wrote the below SPL, but when all index values are null for a specific date, the line itself is not displayed.

複数のindexから、nullには0を代入し、1日ごとのイベント件数を表示させたいです。

chartコマンドを使いイベント件数を表示、特定indexの値がnullの場合はisnullで0を代入できたのですが、特定の日にちだけ全てのindexの値がnullの時、その日の行自体が表示されません。

index IN (index1, index2, index3, index4)
| bin span=1d _time
| chart count _time over index
| eval index4=if(isnull(index4), 0, index4)

How to display a line of 4/2 by substituting 0 like the below table, when all indexes value of 4/2 are null?

下記の表のように4/2の値がなくとも、０を代入して4/2の行を表示させる方法はないでしょうか。

	index1	index2	index3	index4
4/1	12	3	45	0
4/2	0	0	0	0
4/3	16	7	34	0

[ITWhisperer]

| addtotals fieldname=_total
| where _total > 0

[livehybrid]

Hi @mint_choco 

I believe you can either use filldown or fillnull here. 
After your chart command you could use the following, note that you *might not* have to specify all of the fields here, but if you do not specify them then it will only fillnull fields which already exist, therefore if no values for index4 are found then index4 would not appear at all in your chart.

 | fillnull index1 index2 index3 index4 value=0

 If you prefer to use the previous value in its place then use filldown:

| filldown 

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[mint_choco]

Hi, @livehybrid 

Thanks your reply. Unfortunately, it didn't work.

I can fill the col index4 by using fillnull, instead of  "| eval index4=if(isnull(index4), 0, index4)".
But, I got the table like below. The line for 4/2 still missing.

_time	index1	index2	index3	index4
4/1	12	3	45	0
4/3	16	7	34	0
4/4	15	6	70	0

There is no logs on April 2nd, so there is no line for 4/2, I guess.
Is there no way to make line for April 2nd? Maybe should I try without chart command?

[livehybrid · Accepted solution]

Hi @mint_choco 

Before the fillnull you culd try using "makecontinuous"

Something like this (adjust accordingly):

| makecontinuous _time span=1d

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[mint_choco]

@livehybrid 

"makecontinuous" - This is exactly what I need!

I didn't know there is such useful command.
My question is solved.

Thank you!