Hi all, I have a request from a tenant in our environment that requires us to create a dashboard where each column is a date and each row has various criteria. We accomplished this by using the following search structure: [base search]
| timechart limit=0 span=1d useother=false count as "Row 1" by sourcetype
| fillnull
| reverse
| untable _time, sourcetype, "Row 1"
| eval Time= strftime(_time, "%m-%d-%y")
| table Time, "Row 1"
| transpose header_field=Time 0
|append [search [base search] | timechart limit=0 span=1d useother=false count as "Row 1" by sourcetype
| fillnull
| reverse
| untable _time, sourcetype, "Row 2"
| eval Time= strftime(_time, "%m-%d-%y")
| table Time, "Row 2"
| transpose header_field=Time 0]
... Due to the variations in search criteria for each row, it makes the most sense to simply append a new row. The results end up looking like the following: The problem I am having is that one of the searches produces no results almost all of the time (note that Row3 is missing). This tenant would like this to show "Row3" as a row of 0's implying that there were no events that match the specified criteria for that row. Does anybody have a good way to create a timechart table of all 0's for searches that return "No results found"? I have seen a lot of questions and answers on here that basically use an append to give a single value of 0 but for this use case I would essentially like to get a "0" for each date on the table like the following :
... View more