I am working on a search that returns counts by the hour but when the event has not occur, I would still like to fill in the column with zeros instead of it not appearing at all. I have tried fillnull, eval = if, eval =ifnull and it still has the same behavior. Any ideas? How do I create dummy data for when this occurs. sourcetype=x Or sourcetype=y Or Sourcetype=z |timchart count span=1h by sourcetype ... View more

I am trying to write a search that will return a report of event times by hour for each sourcetype. For example, Source1 Source2 Source3 Total 1/1/17 1:00PM 5000 2000 500 7500 1/1/17 2:00PM 4000 1000 100 5100 Any assistance will be appreciated. ... View more