https://community.splunk.com/t5/Splunk-Search/makecontinuous-not-working-for-first-initial-time-span/m-p/560456#M159277 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>&nbsp; Thanks for the reply!</P><P>Can you please help with the complete query here, considering day1 and day7 and also days in between, as same problem may happen for other days as well.</P><P>Appreciate your help</P> Thu, 22 Jul 2021 10:06:39 GMT VS0909 2021-07-22T10:06:39Z https://community.splunk.com/t5/Splunk-Search/makecontinuous-not-working-for-first-initial-time-span/m-p/560445#M159273 <P>If I run the below query for last 7 days, and if there is no data in logs matching condition index=abc "searchTerm" for day1, then the results are showing for day2 to day7.</P><P>But I want a row in resultset for day1 as well, if no data then with TotalResults as 0 for day1.</P><P>index=abc "searchTerm"&nbsp; | bucket _time span=1d | stats count as TotalResults by _time | makecontinuous _time | fillnull TotalResults</P><P>Please help</P><P>&nbsp;</P> Thu, 22 Jul 2021 08:21:01 GMT https://community.splunk.com/t5/Splunk-Search/makecontinuous-not-working-for-first-initial-time-span/m-p/560445#M159273 VS0909 2021-07-22T08:21:01Z https://community.splunk.com/t5/Splunk-Search/makecontinuous-not-working-for-first-initial-time-span/m-p/560451#M159276 <P>makecontinuous works between the lowest value in the field and the highest value in the field - you will need to add (append) a dummy entry for day 1 with TotalResults value of 0. I would then sum the TotalResults by _time (in case there was already a result for day 1, then do the makecontinous etc.</P> Thu, 22 Jul 2021 09:51:44 GMT https://community.splunk.com/t5/Splunk-Search/makecontinuous-not-working-for-first-initial-time-span/m-p/560451#M159276 ITWhisperer 2021-07-22T09:51:44Z https://community.splunk.com/t5/Splunk-Search/makecontinuous-not-working-for-first-initial-time-span/m-p/560456#M159277 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>&nbsp; Thanks for the reply!</P><P>Can you please help with the complete query here, considering day1 and day7 and also days in between, as same problem may happen for other days as well.</P><P>Appreciate your help</P> Thu, 22 Jul 2021 10:06:39 GMT https://community.splunk.com/t5/Splunk-Search/makecontinuous-not-working-for-first-initial-time-span/m-p/560456#M159277 VS0909 2021-07-22T10:06:39Z https://community.splunk.com/t5/Splunk-Search/makecontinuous-not-working-for-first-initial-time-span/m-p/560460#M159278 <P><A href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168" target="_blank">@ITWhisperer</A>&nbsp; Thanks for the reply!</P><P>Can you please help with the complete query here, considering day1 and day7 and also days in between, as same problem may happen for other days as well.</P><P>Appreciate your help</P> Thu, 22 Jul 2021 11:07:57 GMT https://community.splunk.com/t5/Splunk-Search/makecontinuous-not-working-for-first-initial-time-span/m-p/560460#M159278 VS0909 2021-07-22T11:07:57Z https://community.splunk.com/t5/Splunk-Search/makecontinuous-not-working-for-first-initial-time-span/m-p/560470#M159282 <LI-CODE lang="markup">| append [| makeresults | addinfo | rename info_min_time as _time | bin _time span=1d | fields - info_*] | sort _time | makecontinuous _time span=1d | fillnull value=0 TotalResults | stats sum(TotalResults) as TotalResults by _time</LI-CODE> Thu, 22 Jul 2021 13:25:58 GMT https://community.splunk.com/t5/Splunk-Search/makecontinuous-not-working-for-first-initial-time-span/m-p/560470#M159282 ITWhisperer 2021-07-22T13:25:58Z