You can add the following to replace null values as 0 in the statistical table: | fillnull value=0
However, If you are using Bar Graph (or Column as I would expect for timechart command), then zero will not be plotted for obvious reason. You can change to Line Chart to see the Series line drop to zero when data is not present or Zero.
try | timechart span=1mon count|makecontinuous
, otherwise try formatting the visualizations to link zero values using the Format>General>Null Values and it would be the middle option.
query didn't work for me
timechart span=1h count by TYPE | makecontinuous _time span=1h
I got same results , Can you clearly mention steps for second option
you could try to add the makecontinuous before the timechart to see if that helps.
It depends if you're editing in a dashboard or in search.
In a dashboard in the UI, you'll find this option after clicking Edit Panels either from the dashboards page (Under Actions) or once viewing the dashboard by clicking Edit in the upper right corner. To format the chart in a dashboard, you click the little paintbrush in the upper right corner of a panel.
In search, it's the visualization is automatically editable. To format the chart in search, you click Format (it also has a paintbrush next to it) in the upper left hand corner of the Visualization tab.
In the little window that pops up after clicking on the format option, there is a tab called General, it is the first tab displayed. At the top of the General tab, there is an option called Null Values with three buttons next to it. The first one does not connect null values (so if you have a value in January, none in February and one in March, there would be no line connecting them, just the dots on two months). The middle option connects the lines, making a point at 0 for February, and the third option connects them, passing through February,
If you are editing the simpleXML, the option name is charting.chart.nullValueMode and the values are gaps, zero, or connect