https://community.splunk.com/t5/Splunk-Search/stats-count-by-time/m-p/68152#M17054 <PRE><CODE>stats count by _time </CODE></PRE> <P>Hi all, I've a query where i count by _time but if in a day there aren't events it is not show in the count. How can i see also a date with zero events? thanks</P> Mon, 11 Oct 2010 20:49:05 GMT pinzer 2010-10-11T20:49:05Z https://community.splunk.com/t5/Splunk-Search/stats-count-by-time/m-p/68152#M17054 <PRE><CODE>stats count by _time </CODE></PRE> <P>Hi all, I've a query where i count by _time but if in a day there aren't events it is not show in the count. How can i see also a date with zero events? thanks</P> Mon, 11 Oct 2010 20:49:05 GMT https://community.splunk.com/t5/Splunk-Search/stats-count-by-time/m-p/68152#M17054 pinzer 2010-10-11T20:49:05Z https://community.splunk.com/t5/Splunk-Search/stats-count-by-time/m-p/68153#M17055 <P>With the stats command, the only series that are created for the group-by clause are those that exist in the data. If you have continuous data, you may want to manually discretize it by using the <A href="http://www.splunk.com/base/Documentation/latest/SearchReference/Bucket" rel="nofollow">bucket</A> command before the stats command. If you use span=1d _time, there will be placeholder values created for empty days and all other _time values will be snapped to the day.</P> <P>All of this is done for you automatically in the <A href="http://www.splunk.com/base/Documentation/latest/SearchReference/Timechart" rel="nofollow">timechart</A> command. </P> Mon, 11 Oct 2010 21:20:50 GMT https://community.splunk.com/t5/Splunk-Search/stats-count-by-time/m-p/68153#M17055 Dan 2010-10-11T21:20:50Z