show fields with no values in a timechart

[royimad]

Hello Expert,

I'm showing a multilines graph using this search:

sourcetype="mysource" thefield="x" or thefield="y" or thefield="z" | timechart span=1d count by thefield

The graph is showing 2 lines one for x and one for y because there are no values that is equal to "z".

I need to show 3 lines x,y,z on the graph and consider z as zero.
How to do that?

[royimad · Accepted solution]

Try usenull and useother

sourcetype="mysource" thefield="x" or thefield="y" or thefield="z" | timechart span=1d count by thefield usenull=f useother=f

[kasu_praveen]

Is this really working? It didn't work for me.