I have the following search:
index=<index> operation=<operation> | transaction startswith="<>"=request endswith="<>"=response
maxevents=2 | eval interval=case(case(if(isnull(duration),5,duration<1),"0 - 1"), case(if(isnull(duration),5,duration<2),"1 - 2"),case(if(isnull(duration),5,duration<4),"2 - 4"),case(if(isnull(duration),5,duration<8),"4 - 8"),case(if(isnull(duration),5,duration<16),"8 - 16"),case(if(isnull(duration),5,duration<32),"16 - 32")) | bucket duration span=1 as seconds | stats count as nbr by interval| table interval nbr
The result only shows the intervals on the chart that have values and omits the others, what would be the best way to show the missing intervals that have no values on the chart?
... View more