topic Re: How can I display zero-value/empty time when using stats? in Getting Data In

How can I display zero-value/empty time when using stats?

knarayana — Fri, 11 Aug 2017 16:47:50 GMT

Search:

index=* | bin span=1d _time | convert ctime(_time) as Time timeformat=%m/%d/%y |stats  count(eval(searchmatch("(match1)")))  count(eval(searchmatch("(match2)"))) by Time

The query doesn't give me the days that have zero value.

How can I get the stats for every day? And it should show me zero if it is zero on that particular day.

Thanks

Re: How can I display zero-value/empty time when using stats?

sbbadri — Tue, 29 Sep 2020 15:20:53 GMT

index=* | timechart span=1d count(eval(searchmatch("(match1)"))) count(eval(searchmatch("(match2)"))) | eval _time=strftime(_time,"%m/%d/%Y")

Re: How can I display zero-value/empty time when using stats?

woodcock — Fri, 11 Aug 2017 17:42:33 GMT

Use timechart (which creates empty slots by default), like this:

index=*
| timechart span=1d count(eval(searchmatch("(match1)"))) AS match1 count(eval(searchmatch("(match2)"))) AS match2
| rename _time AS Time
| fieldformat Time=strftime(Time, "%m/%d/%y")