Hi,
i want to create a pie chart by different values what works well. I have the following problem: the pie chart shall display 0 when there is no event. I created a search that results a dummy value of 0: |appendpipe [stats count | eval NoResult= "0" | where count=0]
My query: index=abc OR index=def Statuscode="12345"|chart count by index||appendpipe [stats count | eval NoResult= "0" | where count=0]
how is it possible to "combine" the search "chart count by index" with the dummy value?
Thanks for your help!
↧