https://community.splunk.com/t5/Splunk-Search/how-to-use-makecontinuous-in-combination-with-stats-to-fill-in/m-p/338773#M162402 <P>Any update on if this helped?</P> Wed, 14 Mar 2018 15:32:34 GMT skoelpin 2018-03-14T15:32:34Z https://community.splunk.com/t5/Splunk-Search/how-to-use-makecontinuous-in-combination-with-stats-to-fill-in/m-p/338768#M162397 <P>Hello, </P> <P>I have this search query: </P> <PRE><CODE>sourcetype="device" | bucket span=1d _time | makecontinuous _time | stats count by _time, user | fillnull count </CODE></PRE> <P>I was expecting that by using makecontinuous the days when the count was 0 will also be added to the results. With this query I get this result.</P> <PRE><CODE> _time user count 2017-08-18 user2 5 2017-08-21 user2 1 2017-08-25 user2 4 2017-08-27 user2 1 2017-08-30 user2 6 </CODE></PRE> <P>I was expecting this result:</P> <PRE><CODE>_time user count 2017-08-18 user2 5 2017-08-19 user2 0 2017-08-20 user2 0 2017-08-21 user2 1 2017-08-22 user2 1 .....and so on 2017-08-25 user2 4 2017-08-26 user2 0 2017-08-27 user2 1 2017-08-30 user2 6 </CODE></PRE> <P>I know that this would work well with timechart but I really need to use stats, so that I can then use the results in Machine Learning Toolkit, and timechart would not work there.</P> Sun, 11 Mar 2018 14:26:10 GMT https://community.splunk.com/t5/Splunk-Search/how-to-use-makecontinuous-in-combination-with-stats-to-fill-in/m-p/338768#M162397 jorjiana88 2018-03-11T14:26:10Z https://community.splunk.com/t5/Splunk-Search/how-to-use-makecontinuous-in-combination-with-stats-to-fill-in/m-p/338769#M162398 <P>@jorjiana88, try the timechart command.</P> <PRE><CODE>sourcetype="device" user="*" | timechart count by user useother=f limit=0 </CODE></PRE> Sun, 11 Mar 2018 16:53:46 GMT https://community.splunk.com/t5/Splunk-Search/how-to-use-makecontinuous-in-combination-with-stats-to-fill-in/m-p/338769#M162398 niketn 2018-03-11T16:53:46Z https://community.splunk.com/t5/Splunk-Search/how-to-use-makecontinuous-in-combination-with-stats-to-fill-in/m-p/338770#M162399 <P>It is not an option to use timechart because it changes how the result is displayed and I cannot later apply some machine learning algorithm after timechart. I really need to use stats.</P> Sun, 11 Mar 2018 18:31:07 GMT https://community.splunk.com/t5/Splunk-Search/how-to-use-makecontinuous-in-combination-with-stats-to-fill-in/m-p/338770#M162399 jorjiana88 2018-03-11T18:31:07Z https://community.splunk.com/t5/Splunk-Search/how-to-use-makecontinuous-in-combination-with-stats-to-fill-in/m-p/338771#M162400 <P>You have some options here. Since the MLTK is appending stats on there, any command such as <CODE>fillnull</CODE> or <CODE>makecontineous</CODE> will not solve your issue since it needs to be passed after timechart/stats. </P> <P>You need to mock up some dummy data and set its values to zero then allow stats to fill in any non-null values. </P> <P>An example would look like this </P> <PRE><CODE>| makeresults | eval field1="" | eval field2="" | append [| search index=... sourcetype=... | bin _time span=10m | stats count by _time | fillnull value=0] </CODE></PRE> <P>So if your time range a 60 min span. The <CODE>makeresults</CODE> command will create 6 bins with 10 minute time spans and will fill any empty bin with a zero. You could also take the approach of using a lookup table to populate your null values or you could use the internal index to populate placeholders to prevent null values.</P> Sun, 11 Mar 2018 21:00:20 GMT https://community.splunk.com/t5/Splunk-Search/how-to-use-makecontinuous-in-combination-with-stats-to-fill-in/m-p/338771#M162400 skoelpin 2018-03-11T21:00:20Z https://community.splunk.com/t5/Splunk-Search/how-to-use-makecontinuous-in-combination-with-stats-to-fill-in/m-p/338772#M162401 <P>@jorjiana88, is it one of built in Machine Learning Toolkit Algorithm, or you are trying to create your own?</P> <P>Can you please give the Algorithm you are trying to use? Outputwise, timechart command above generates same fields as stats command in your query, so I don't see how the two would be picked up differently by the algorithm.</P> Tue, 13 Mar 2018 04:00:34 GMT https://community.splunk.com/t5/Splunk-Search/how-to-use-makecontinuous-in-combination-with-stats-to-fill-in/m-p/338772#M162401 niketn 2018-03-13T04:00:34Z https://community.splunk.com/t5/Splunk-Search/how-to-use-makecontinuous-in-combination-with-stats-to-fill-in/m-p/338773#M162402 <P>Any update on if this helped?</P> Wed, 14 Mar 2018 15:32:34 GMT https://community.splunk.com/t5/Splunk-Search/how-to-use-makecontinuous-in-combination-with-stats-to-fill-in/m-p/338773#M162402 skoelpin 2018-03-14T15:32:34Z https://community.splunk.com/t5/Splunk-Search/how-to-use-makecontinuous-in-combination-with-stats-to-fill-in/m-p/338774#M162403 <P>Perhaps this could help if you wanted it in another format?</P> <PRE><CODE>| timechart limit=0 span=5m count by user | fillnull | untable _time, user, count ... </CODE></PRE> <P>I've used that trick to fill in the missing time points before...let me know if that helps!</P> Fri, 16 Mar 2018 08:22:05 GMT https://community.splunk.com/t5/Splunk-Search/how-to-use-makecontinuous-in-combination-with-stats-to-fill-in/m-p/338774#M162403 gjanders 2018-03-16T08:22:05Z https://community.splunk.com/t5/Splunk-Search/how-to-use-makecontinuous-in-combination-with-stats-to-fill-in/m-p/338775#M162404 <P>this works, I would mark this as answer, but it is a reply, so I cannot mark it.</P> Fri, 16 Mar 2018 16:56:31 GMT https://community.splunk.com/t5/Splunk-Search/how-to-use-makecontinuous-in-combination-with-stats-to-fill-in/m-p/338775#M162404 jorjiana88 2018-03-16T16:56:31Z https://community.splunk.com/t5/Splunk-Search/how-to-use-makecontinuous-in-combination-with-stats-to-fill-in/m-p/338776#M162405 <P>Your answer helped to understand why it does not work. <BR /> Someone else suggested the solution in one of the replies: </P> <P>| timechart limit=0 span=5m count by user<BR /> | fillnull <BR /> | untable _time, user, count</P> Fri, 16 Mar 2018 16:57:32 GMT https://community.splunk.com/t5/Splunk-Search/how-to-use-makecontinuous-in-combination-with-stats-to-fill-in/m-p/338776#M162405 jorjiana88 2018-03-16T16:57:32Z https://community.splunk.com/t5/Splunk-Search/how-to-use-makecontinuous-in-combination-with-stats-to-fill-in/m-p/338777#M162406 <P>Moved to answer!</P> Sat, 17 Mar 2018 04:07:58 GMT https://community.splunk.com/t5/Splunk-Search/how-to-use-makecontinuous-in-combination-with-stats-to-fill-in/m-p/338777#M162406 gjanders 2018-03-17T04:07:58Z https://community.splunk.com/t5/Splunk-Search/how-to-use-makecontinuous-in-combination-with-stats-to-fill-in/m-p/338778#M162407 <P>Could you please elaborate your solution a bit ? I am faced with a similar issue where _time is discontinuous and MLTK throws error as I try to fit or apply model. TIA. FYI , I am quite new to Splunk but learning things fast. </P> Fri, 05 Jul 2019 19:49:43 GMT https://community.splunk.com/t5/Splunk-Search/how-to-use-makecontinuous-in-combination-with-stats-to-fill-in/m-p/338778#M162407 bibinksebastian 2019-07-05T19:49:43Z https://community.splunk.com/t5/Splunk-Search/how-to-use-makecontinuous-in-combination-with-stats-to-fill-in/m-p/338779#M162408 <P>I've come up with a much better solution since posting this reply. Ask a new question and I will give you the code </P> Mon, 08 Jul 2019 13:45:16 GMT https://community.splunk.com/t5/Splunk-Search/how-to-use-makecontinuous-in-combination-with-stats-to-fill-in/m-p/338779#M162408 skoelpin 2019-07-08T13:45:16Z https://community.splunk.com/t5/Splunk-Search/how-to-use-makecontinuous-in-combination-with-stats-to-fill-in/m-p/338780#M162409 <P>Thanks . I used time chart to fix my issue currently . please let me know if your soln is different , I will start off a new thread . </P> Thu, 11 Jul 2019 18:48:00 GMT https://community.splunk.com/t5/Splunk-Search/how-to-use-makecontinuous-in-combination-with-stats-to-fill-in/m-p/338780#M162409 bibinksebastian 2019-07-11T18:48:00Z