How to write this complex search displayed with a transpose _time command?

[jip31]

Hello

I use a complex search with display results ordered by time in a table 

As you can see the time period is today between 7h and 19h

| appendcols 
    [ search `index` type=* earliest=@d+7h latest=@d+19h 
    | search web_domain=sharepoint.com 
    | search web_duration_ms > 7000 
    | stats count as PbPerf by sam _time 
    | timechart span=1h dc(sam) as "SHAREPOINT - Nb d'utilisateurs ayant un temps de réponse > 7 sec" 
        ] 
| appendcols 
    [ search `index`  type=* earliest=@d+7h latest=@d+19h 
    | search web_domain=laposte.sharepoint.com 
    | timechart span=1h count as "SHAREPOINT - Nb d'erreurs" 
        ] 
| where _time <now() 
| eval time=strftime(_time,"%H:%M") 
| sort time 
| fields - _time _span _origtime 
| transpose 0 header_field=time column_name=KPI 
| fillnull value=0 
| sort + KPI

The results are displayed like this

In the KPI field, I have 10 differents items

The problem I have is when I run the dashboard at 7h, I have just one or 2 items displayed without results in the span = 7h all the more that the column corresponding to 7h is not displayed!

Items start to be displayed when there is a result > 0 and in this case the column "7h" is well displayed

What I need is when I launch the dashboard at 7h and even if the time is less than 8h, I have all the items for the KPI column displayed and the column "7h" too with results=0 if there is no results or of course with results if there is results

could you help me on this complex need please?

[jip31]

Pearhaps I found a solution with appendpipe

can i use this solution?

| appendcols 
    [ search `index` earliest=@d+7h latest=@d+19h 
    | timechart span=1h count as "DOSSIER - Nb d'erreurs" 
    | appendpipe 
        [ stats count as _events 
        | where _events = 0 
        | eval "DOSSIER - Nb d'erreurs" = 0 ]
        ]