topic Re: Add zero value when using _time field in Splunk Search

Add zero value when using _time field

whitefang1726 — Tue, 27 Apr 2021 12:38:06 GMT

When using stats count on searches, it does not show zero values on specific time intervals.

Example:
index=main sourcetype=test (event=eventA OR eventB)
| bin _time span=1h
| stats count by _time, event

Sample Result:

_time Event count
04/27 1:00AM EventA 10
04/27 2:00AM EventA 10
04/27 1:00AM EventB 10

How can I show row with zero value?
_time Event count
04/27 1:00AM EventA 10
04/27 2:00AM EventA 10
04/27 3:00AM EventA 0
04/27 1:00AM EventB 10
04/27 2:00AM EventB 0
04/27 3:00AM EventB 0

Re: Add zero value when using _time field

richgalloway — Tue, 27 Apr 2021 13:11:01 GMT

The stats command will not fill in missing values, but timechart will.

index=main sourcetype=test (event=eventA OR eventB) | timechart span=1h count by event

Re: Add zero value when using _time field

whitefang1726 — Wed, 28 Apr 2021 02:01:39 GMT

I was expecting a non-timechart command, but that works. Better than creating long queries. 😄

Thanks!

Re: Add zero value when using _time field

richgalloway — Wed, 28 Apr 2021 12:29:26 GMT

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.