Already using a query with below to get total number:
| timechart span=1d count
What can I add to return, show a "0" if the query is null?
| timechart span=1d count
| fullnull
| appendpipe
[ stats count as _events
| where _events = 0
| eval count = 0]