Splunk Search

how can I show all labels on X-axis, even results are zero with timechart commnad


I wanna show data for the last ten months on bar graph, few months does,t have data so, those are not appeared on graph

| timechart span=1 mon count

this is not showing bars, if month result is zero, how can show all labels on x-axis even the result is zero

Tags (2)
0 Karma


You can add the following to replace null values as 0 in the statistical table: | fillnull value=0

However, If you are using Bar Graph (or Column as I would expect for timechart command), then zero will not be plotted for obvious reason. You can change to Line Chart to see the Series line drop to zero when data is not present or Zero.

| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Super Champion

try | timechart span=1mon count|makecontinuous, otherwise try formatting the visualizations to link zero values using the Format>General>Null Values and it would be the middle option.


query didn't work for me

timechart span=1h count by TYPE | makecontinuous _time span=1h

I got same results , Can you clearly mention steps for second option

0 Karma

Super Champion

you could try to add the makecontinuous before the timechart to see if that helps.

0 Karma

Super Champion

It depends if you're editing in a dashboard or in search.

In a dashboard in the UI, you'll find this option after clicking Edit Panels either from the dashboards page (Under Actions) or once viewing the dashboard by clicking Edit in the upper right corner. To format the chart in a dashboard, you click the little paintbrush in the upper right corner of a panel.
In search, it's the visualization is automatically editable. To format the chart in search, you click Format (it also has a paintbrush next to it) in the upper left hand corner of the Visualization tab.

In the little window that pops up after clicking on the format option, there is a tab called General, it is the first tab displayed. At the top of the General tab, there is an option called Null Values with three buttons next to it. The first one does not connect null values (so if you have a value in January, none in February and one in March, there would be no line connecting them, just the dots on two months). The middle option connects the lines, making a point at 0 for February, and the third option connects them, passing through February,

If you are editing the simpleXML, the option name is charting.chart.nullValueMode and the values are gaps, zero, or connect

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!