I have a search that returns number of apache processes per host:
sourcetype="ps" earliest="-7m" | multikv filter apache | search USER="apache" | timechart span=30s count as linecount_apache by host
However, this results in 0 values for some hosts for last or first rows when, presumably, some data is out of range or isn't available yet. What would be the best way to hide or replace these 0s with nulls so they are not displayed on the report? Piping to eval or replace like this:
| eval linecount_apache=if(linecount_apache==0,null,linecount_apache)
seemed to have no effect on the result. Thank you.
... View more