Hello, I have the search below which should graph the count of the error messages grouped by criticality; the visualisation is "single value" with trellis split by criticality. it all works as long...
See more...
Hello, I have the search below which should graph the count of the error messages grouped by criticality; the visualisation is "single value" with trellis split by criticality. it all works as long as there are values found. when there are no events found for one criticality value, the trellis graph not displayed; when events for both criticality values aren't found, the "no results found" message is displayed. I'm looking for a way to simulate the fillnull function in the case of missing events; I have tried the solutions with makeresults and appendpipe (as described here, here and here), but none worked for me. The goal is to have zeroes for each time period automatially calculated by timechart where the events are missing. I guess the count column cannot be initialised somehow, as long as there is no value for the selected time period (the "search criticality = ...." subsearch) cheers index=<index> source=<source>
| rex ".\d{3}Z\s(app|batchrun\s-\s\w+)\s(?<loglevel>1|2|3|4|5)\s"
| eval criticality=case(loglevel == "1", "error", loglevel == "2", "warning", loglevel == "3", "info", loglevel == "4", "debug")
| search criticality = error OR criticality = info OR criticality = warning
| timechart count by criticality