timechart - add some columns and values are 0

[TSamon]

Hello, 

Based on this Splunk Query:

index=* AND appid=127881 AND message="*|NGINX|*"

AND cluster != null AND namespace != null | eval server = (namespace + "@" + cluster)

| timechart span=1d count by server

Because the logs are only kept for 1 month, and in recent month, logs are only in server 127881-p@23p. So in the splunk query result, we only can see 1 column: 127881-p@23p

May I ask how to make the result has 3 columns: 127881-p@23p, 127881-p@24p, 127881-p@25p

And since there is no logs in 24p and 25p rencently, the values for 24p and 25p are 0.

Thanks a lot!

[yuanliu · Accepted solution]

By "make the result has 3 columns," do you mean that when logs only come from less than 3 servers, you still want to display the one with no logs (with value 0)?

In that case, you must know the exact name of the three servers.  Then, use foreach to fill the values.

index=* AND appid=127881 AND message="*|NGINX|*"
  AND cluster != null AND namespace != null
| eval server = (namespace + "@" + cluster)
| timechart span=1d count by server
| foreach "127881-p@23p", "127881-p@24p", "127881-p@25p"
    [eval <<FIELD>> = if(isnull('<<FIELD>>'), 0, '<<FIELD>>')]

[TSamon]

Many thanks! Yes, it is what I want, your answer is very helpful! Many thanks!