Timechart show no 'zero' values

[mkelderm]

My query shows only values when it finds an event. I want also the 0 events per span in my chart. I thought this was working in Splunk> 5.x

index=prd_access sourcetype=access:web:agw earliest=-14d "No ESP" | timechart span=1d count

Note: We are running Splunk 6.0

Regards,

Marc

[mkelderm · Accepted solution]

Use fillnull 🙂

index=prd_access sourcetype=access:web:agw earliest=-14d "No ESP" | fillnull value=NoEsp| timechart span=1d count as NoEsp