I can see how fillnull would be helpful if some events did not have a status value. However, that is not the problem I'm trying to solve.  Here is a simplified scenario where the status is set for all events: index="applications-esl" | eval status = "Success" | table _time, status But there are no events, in the time range selected, there is nothing to fill. In this case I just get a "No results found. Try expanding the time range." when I really want an empty graph that reflects the selected time range on the x-axis. ... View more

Put another way; If I select a time range that does not contain any events, how can I still see a graph for the selected time range, even though it does not contain any data?  ... View more

Something like this: index="applications-esl" | spath input=properties.message | rename message.id as s4-uuid | eval _time=strptime(time, "%FT%T.%QZ") | sort +_time limit=0 | stats last(_time) as _time, list(logMsg) as log, by s4-uuid | eval status = case(match(log,"(?i).*successfully.*"),"Success", match(log,".*"),"Failed") | table _time, status | search status="Success" | timechart span=1m count Thanks. ... View more