https://community.splunk.com/t5/Splunk-Search/Fill-missing-values-from-stats-command/m-p/533074#M150597 <P>Depending on what statistics you producing, you may be able to replace <FONT face="courier new,courier">stats</FONT> with <FONT face="courier new,courier">timechart</FONT>, which automatically fills in missing time periods.</P> Mon, 14 Dec 2020 22:17:16 GMT richgalloway 2020-12-14T22:17:16Z https://community.splunk.com/t5/Splunk-Search/Fill-missing-values-from-stats-command/m-p/533069#M150593 <P>I am using a bin of 10 minutes with stats for the past hour. What I am running into is that when doing so not all items in my stats command have a count for one of the buckets. For example one might show up for the 10, 20, 40 minute buckets but, I want to the 30 and 50 minute buckets to show blank values. What is the best way to accomplish this? Fillnull does not work for this since there is no null value, the value just is not showing at all.</P> Mon, 14 Dec 2020 20:48:26 GMT https://community.splunk.com/t5/Splunk-Search/Fill-missing-values-from-stats-command/m-p/533069#M150593 aohls 2020-12-14T20:48:26Z https://community.splunk.com/t5/Splunk-Search/Fill-missing-values-from-stats-command/m-p/533074#M150597 <P>Depending on what statistics you producing, you may be able to replace <FONT face="courier new,courier">stats</FONT> with <FONT face="courier new,courier">timechart</FONT>, which automatically fills in missing time periods.</P> Mon, 14 Dec 2020 22:17:16 GMT https://community.splunk.com/t5/Splunk-Search/Fill-missing-values-from-stats-command/m-p/533074#M150597 richgalloway 2020-12-14T22:17:16Z