I want to have a graph where where you can easily see when that system is no longer taking kerberos authentications.  But when it doesn't show anything for over 12h, then that object is no longer in that graph. Is there a way to keep my servers showing even if there are 0 events for that time period? index=perfmon source="Perfmon:Security System-Wide Statistics" counter="Kerberos Authentications" earliest=-12h latest=now [inputlookup Prod_DC.csv] | eval host=lower(host) |bucket span=5m time | stats count by _time,host|eval count=if(count>0,1,0) |timechart span=5m limit=0 last(count) by host ... View more