topic How to get stats count to include zero count by time? in Splunk Search

How to get stats count to include zero count by time?

lukas — Tue, 11 Aug 2020 09:55:37 GMT

Hi,
I have a lookup file like this -

users:

User1

User2

User3

User4

...

I need to count the events by user:

It shows me the number of events per user in the CSV file.
If a user has no events, the count is 0:

But I need the output additionally splitted over time (span=1h).
The output should look like this:

I saw few other questions in splunk answers but they didnt work for me...
I hope you could help me. Thank a lot!

richgalloway — Tue, 11 Aug 2020 12:50:31 GMT

Perhaps this will help.

lukas — Tue, 11 Aug 2020 13:24:24 GMT

Thanks for the feedback. Unfortunately it does not work, if I use the timechart command like this, I do not get any results back.