I have a chart with various counts of errors and corresponding Sparklines.
In this instance the null values are just as important as non-zero values, so I used fillnull to fill the Null count fields with zero.
Unfortunately the sparkline fields are blank which breaks the visual continuity of the chart.
How do I fill a null sparkline field with a flat sparkline?
This is my final search. It replaces the empty fields with a flat sparkline, then renames and reorders the columns.
sourcetype=*application* severity=ERROR
| chart count sparkline over app by host | rename "sparkline: server1" AS server1, "sparkline: server2" AS server2
| eval server1= mvjoin(server1, "%%%") | eventstats max(server1) as temp | eval temp = replace(temp, "\d+", "0") | eval server1= coalesce(server1, temp) | makemv delim="%%%" server1| fields - temp
| eval server2= mvjoin(server2, "%%%") | eventstats max(server2) as temp | eval temp = replace(temp, "\d+", "0") | eval server2= coalesce(server2, temp) | makemv delim="%%%" server2| fields - temp
| rename app as Application, server1 as "Errors per half hour on server1", server2 as "Errors per half hour on server2", "count: server2" as "Total Errors on server2", "count: server1" as "Total Errors on server1"
| table Application, "Total Errors on server2" "Errors per half hour on server2" "Total Errors on server1" "Errors per half hour on server1"
... View more