Splunk Search

Timechart show no 'zero' values

mkelderm
Path Finder

My query shows only values when it finds an event. I want also the 0 events per span in my chart. I thought this was working in Splunk> 5.x

index=prd_access sourcetype=access:web:agw earliest=-14d "No ESP" | timechart span=1d count

Note: We are running Splunk 6.0

Regards,

Marc

Tags (1)
0 Karma
1 Solution

mkelderm
Path Finder

Use fillnull 🙂

index=prd_access sourcetype=access:web:agw earliest=-14d "No ESP" | fillnull value=NoEsp| timechart span=1d count as NoEsp

View solution in original post

mkelderm
Path Finder

Use fillnull 🙂

index=prd_access sourcetype=access:web:agw earliest=-14d "No ESP" | fillnull value=NoEsp| timechart span=1d count as NoEsp

View solution in original post

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.